How do we stop criminals sending e-mail that pretends to come from our domain?

Publish three DNS records that let receiving mail servers check your mail. SPF lists the servers that are allowed to send for your domain. DKIM adds a cryptographic signature to each outgoing message. DMARC tells receivers what to do when a message fails those checks, and sends you reports on who is sending in your name. Start DMARC with the policy none, which only reports, and read the reports for a few weeks to find every legitimate sender: your mail provider, newsletter tool, invoicing system and CRM. Add them to SPF and DKIM, then move to quarantine and finally to reject. Since 2024, Google and Yahoo have required DMARC from bulk senders, so this also protects your deliverability. It stops exact forgeries of your domain, not lookalike domains, which need monitoring and takedown requests instead.

← All 29 questions on Phishing and e-mail aftermathAll topics