SPF, DKIM and DMARC: Stopping Email Spoofing in Plain English

Here's an uncomfortable fact: sending an email that appears to come from yourbusiness.com.au takes a scammer about thirty seconds. No hacking required — email was invented before anyone worried about proving who the sender was. Three settings fix this, and most small businesses have never heard of them.

The three settings, translated

SPF is a guest list. It tells the world which mail servers are allowed to send email for your domain. Not on the list? Suspicious.

DKIM is a wax seal. Every genuine email from your domain carries a cryptographic signature that proves it wasn't forged or tampered with in transit.

DMARC is the instruction to the bouncer. It tells receiving mail servers what to do when an email fails those checks — let it through, quarantine it, or reject it outright — and it sends you reports so you can see who's trying to impersonate you.

Why it matters more than it used to

Two reasons. First, AI-written phishing has made fake invoices and "please pay into this new account" emails convincing enough to fool careful people — and they land better when they appear to come from a real business the victim already deals with. Second, Google and Yahoo now require these settings for bulk senders, and increasingly treat unauthenticated email as spam. If your quotes and invoices are landing in junk folders, missing DMARC is a prime suspect.

The catch

Setting these up wrong can break your own email — newsletters, accounting software and website contact forms all send "as you" and each needs to be accounted for. It's a careful, one-time job: inventory everything that sends email for your domain, then switch the settings on in stages, watching the reports as you go.

Not sure whether yours are set? It takes us minutes to check. Book a free consultation and we'll tell you where your domain stands — and what your email deliverability looks like while we're at it.