Check whether anyone can send email as your business, in 30 seconds
Most small business domains still let a stranger send email that says it is from you. One free lookup tells you, and the fix is three DNS records.
By Chen Deng · OxOne, Calgary AB
- Time30 seconds to check
- You needDNS access
- Risk if unfixedInvoice fraud, and your own mail in spam
Look up your domain on a free DMARC checker. If it reports no DMARC record, or a record that says p=none, anybody can send email that appears to come from your business and nothing will stop it.
We check this on every prospect's domain before a first call, and it is broken more often than it is not. It takes half a minute and it is the cheapest security fix a small business will ever make.
The check
If you have a terminal, this is the whole thing:
dig +short TXT _dmarc.yourdomain.caNo terminal? Any free DMARC lookup tool does the same. You are looking for a line that starts v=DMARC1.
Reading the answer
| What comes back | What it means | Protected? |
|---|---|---|
| Nothing | No DMARC record at all. Anyone can send as you and no mail server has been told to object. | No |
p=none | A record that explicitly asks the world to do nothing about forgeries. Monitoring only. The most common result. | No |
p=quarantine | Forgeries are sent to spam. | Mostly |
p=reject | Forgeries are refused outright. This is the destination. | Yes |
Why this is worth half an hour
Two reasons, and the second is the one people miss.
The obvious one: invoice fraud. Somebody emails your customer as you, with new banking details, and your customer pays them. It is a common attack on trades and contractors precisely because the domains are usually unprotected.
The one nobody mentions: your own email deliverability. Gmail and Microsoft now weigh authentication heavily. If your domain does not authenticate properly, your quotes and invoices land in spam and you never find out — you just think the customer ghosted you.
How to actually fix it
- SPF first. One TXT record listing everything allowed to send as you — your email provider, plus anything else that sends on your behalf: your booking system, your invoicing tool, your newsletter.
- DKIM next. Your email provider generates this. It is a couple of records you paste into DNS. Every provider has a one-page guide.
- DMARC last, and start at
p=none. Publish it, collect reports for two to four weeks, and confirm every legitimate sender passes. - Then move to
p=quarantine, thenp=reject. Do not jump straight to reject. If one of your real senders is misconfigured you will silently stop your own invoices from arriving.
The whole sequence is maybe thirty minutes of work spread over a month of waiting. The waiting is the important part — that is what stops you from blocking yourself.
Every one of these came out of work we actually did. If you would rather not do it yourself, book a free 30-minute diagnostic and we will tell you which of these your business is losing money to.