Can criminals send email pretending to be you?

SPF is the list of servers allowed to send email for your domain.DKIM is a tamper-proof signature on each message. DMARC is the instruction that tells the world what to do with mail that fails those checks: deliver it anyway, quarantine it, or reject it. Without all three configured, criminals can send convincing email as your business, to your customers, your suppliers, and your own staff. Receiving mail servers also increasingly send legitimate mail to junk when these records are missing, so getting them right helps your deliverability too.

These records live in your domain's DNS and cost nothing but configuration. They are also one of the first things we look at in thefree IT health check, and the background is covered in our post onwhy staff click phishing emails.