If your business uses email, there are three DNS records that should be in place on your domain to protect it from being used by criminals to send fake emails. These records are called SPF, DKIM and DMARC. Most businesses either do not have them set up or have them set up incorrectly, and many do not know until a client calls to say they received a suspicious invoice.
What each one does
SPF tells the world which mail servers are allowed to send email on behalf of your domain. If a server not on that list tries to send email appearing to come from you, receiving mail servers can flag or reject it.
DKIM adds a digital signature to every email you send. The receiving server checks that signature to confirm the email genuinely came from you and was not tampered with in transit.
DMARC ties the two together and tells receiving servers what to do if an email fails those checks, whether to deliver it, send it to spam or reject it outright.
Without all three in place, anyone on the internet can send an email that looks like it came from your business address. Your clients could receive fake invoices with different banking details and have no way of knowing they did not come from you.
How to check your domain
Go to mxtoolbox.com. In the search box type your domain name, for example yourbusiness.co.za. Use the dropdown to run SPF, DKIM and DMARC lookups one at a time. The results will tell you whether each record exists and whether it is configured correctly.
If any of the three are missing or showing errors, your domain is not fully protected.
Getting it fixed
Setting these records up correctly requires access to your domain DNS settings and an understanding of how each record needs to be configured for your specific mail provider. Done incorrectly they can cause legitimate emails to stop delivering. If you are not confident doing this yourself, it is worth getting someone who is to handle it properly.
When to get help
If any of your records are missing, failing or you are not sure how to configure them, do not guess. Incorrect DNS changes can stop your email from working entirely. Recloud configures and monitors SPF, DKIM and DMARC for our clients to ensure email deliverability and domain protection.