The problem, in one paragraph
Email was designed in a more trusting era, and the sender address on a message is closer to a return address written on an envelope than to a checked ID. Unless your domain publishes the right records, a scammer anywhere in the world can send a message that appears to come from your business: your name, your domain, your branding copied from your website. Your customers have no reliable way to tell it apart from your real mail.
Three protections, in plain words
SPF is a public list, published with your domain, that names the services allowed to send email for it: your mail provider, your invoicing software, your website's contact form, and so on. A receiving server can compare the service that actually delivered a message against that list.
DKIM adds a digital signature to your real outgoing mail. The receiving server can verify the signature against a key your domain publishes. Mail that was forged, or altered on the way, fails the check.
DMARC is the instruction sheet that ties the other two together. It tells receiving servers what to do with mail that uses your domain but fails the checks, and it asks them to send reports back to you about what they are seeing.
What a check on your domain finds
- No DMARC record at all. Your domain publishes no instructions, so forged mail in your name meets no policy barrier at the receiving server.
- A record set to monitoring only, written as p=none. Reports flow back to you, which is useful, but receivers are told to take no action, so spoofed mail still gets through. Visibility is not protection.
- An enforced record, set to quarantine or reject. Mail that fails the checks is filed as spam or refused before it reaches the inbox. This is the setting that actually protects your name.
What it costs a business like yours
The damage is practical, not theoretical. A customer receives an invoice that looks exactly like yours, with one detail changed: the payment details. They pay it, and the money is gone. Or the quieter version: because receivers cannot reliably tell your real mail from forgeries, your genuine quotes, invoices and appointment reminders start landing in spam, and you never hear about the jobs you lost. Both problems trace back to the same missing instructions on your domain.
Moving to enforcement is normally done in steps. Records are published, the reports are watched for a while so every legitimate service that sends for you is accounted for, and only then is the policy raised to quarantine or reject. Skipping the watching step is how a business accidentally blocks its own invoices, so the order matters.
Check your domain, free
The free checks on our homepage include a DMARC check that reads your domain's published records and reports which of the three states above you are in. Our email spoofing page walks through what each result means and what closing the gap involves.