Your Business Email Has a Front Door. Is It Locked?

Most small business owners would never leave the shop unlocked overnight. They check the back door, set the alarm, and maybe ask a neighbor to keep an eye out. But many of those same owners have an email domain that anyone in the world can use to send messages in their name.

That sounds dramatic, but it’s how email was built. When email was designed decades ago, nobody planned for strangers to fake a sender address. Today, faking one takes a few minutes. Criminals use it to send fake invoices, fake password resets and fake “urgent” requests that look like they came from you.

The good news is that the fix is not complicated. If you can picture how you lock up a house, you can understand how to protect your business email. Let’s walk through it room by room.

The open door: what email spoofing really is

Imagine someone prints a letter on paper that looks exactly like your company letterhead. They sign your name and mail it to your best customer, asking them to pay an invoice to a new bank account. Your customer has no easy way to know it wasn’t you.

That’s email spoofing. The attacker doesn’t need to break into your email account. They simply send a message that says it’s from yourname@yourbusiness.com, and without the right settings, many inboxes will believe it.

The damage is real. A customer pays a fake invoice. A supplier sends private details to the wrong person. Or your real emails start landing in spam because your domain now looks suspicious. Losing data hurts, which is why so many people now take a practical approach to data backup. Losing trust hurts even more, and it’s harder to back up.

Step 1: Write a list of who has a key (SPF)

The first lock is called SPF, short for Sender Policy Framework. Think of it as a list taped inside your front door that says who is allowed to have a key.

In email terms, SPF is a short line of text you add to your domain settings. It lists the services allowed to send email for your business. That usually means your email provider, plus any tools that send on your behalf, like a newsletter service, an online store or a booking system.

When an inbox gets a message from your domain, it checks the list. If the sender isn’t on it, that’s a red flag.

Two tips here:

• Include every tool that sends for you. Forgetting your invoicing app is the most common reason real emails fail.
• Keep the list short. SPF has a limit of 10 lookups. If you keep adding services, you can hit that limit, and then the check stops working.

Step 2: Add a signature only you can make (DKIM)

A list of keyholders is useful, but keys can be copied. So the second lock is DKIM, which stands for DomainKeys Identified Mail.

DKIM works like a wax seal on a letter. Your email service stamps each message with a hidden digital signature. The matching public key sits in your domain settings, so any inbox can check the seal. If someone changed the message on the way, or if a stranger tries to fake it, the seal won’t match.

Most email providers set up DKIM with a few clicks and one record you copy into your domain settings. If your provider offers it and you haven’t turned it on, do it this week.

Step 3: Put the guest list on the door (DMARC)

Here’s the part most small businesses skip, and it’s the one that ties everything together.

SPF and DKIM are checks, but they don’t tell an inbox what to do when a check fails. Should the email still be delivered? Sent to spam? Blocked? That decision belongs to DMARC, short for Domain-based Message Authentication, Reporting and Conformance.

If SPF is the keyholder list and DKIM is the wax seal, DMARC is the doorman with clear orders. It tells every inbox: “If a message claims to be from us and fails the checks, here is what to do with it. And please send us a report.”

A DMARC record has three main policy options:

• p=none: watch only. Nothing is blocked, but you get reports showing who is sending email as you.
• p=quarantine: failed emails go to spam.
• p=reject: failed emails are blocked completely.

You don’t need to write this record by hand. A free tool like a DMARC Record Generator lets you pick your policy and the email address for reports, then gives you a ready line of text to paste into your domain settings. It takes about five minutes, and it removes the risk of a typo breaking the whole thing.

Start with p=none. It’s the safe first step because it blocks nothing. It simply lets you watch.

Step 4: Read the visitor log (DMARC reports)

Once DMARC is in place, inbox providers start sending you reports. These show every service that sent email using your domain, and whether it passed or failed.

The first time you read them, you might be surprised. You may find a forgotten tool still sending emails, a partner sending on your behalf, or a server in another country you’ve never heard of. That last one is exactly what you want to catch.

The raw reports are written in a format meant for computers, so most people use a report reader to turn them into simple charts. Spend a few weeks reading them. Fix any real senders that fail by adding them to SPF or turning on DKIM for them.

Step 5: Lock the door for real

When your reports show that all your real email passes, it’s time to tighten up. Move your policy from p=none to p=quarantine. Watch for another few weeks. If nothing breaks, move to p=reject.

At p=reject, fake emails using your domain are blocked before they reach anyone. Your customers never see them. That’s the locked door.

This step-by-step pace matters. Jumping straight to reject on day one can block your own invoices or newsletters if a sender was missed. Slow and steady keeps your real mail flowing.

Common mistakes that leave the door half open

Even owners who set things up can make small mistakes. These are the ones that come up most often:

1. Stopping at p=none forever. Watching is the first step, not the finish line. A p=none policy protects no one on its own.
2. Having two SPF records. Your domain can only have one. Two records cancel each other out.
3. Forgetting new tools. Every time you add a service that sends email, update SPF and DKIM.
4. Ignoring unused domains. If you own a domain that doesn’t send email, add a strict DMARC record to it too. Attackers love quiet domains.
5. Never checking the reports. If no one reads them, you won’t notice when something changes.

Why this matters more every year

Big email providers now expect this. Since 2024, Google and Yahoo have required DMARC for businesses that send large amounts of email. Smaller senders that skip these steps often see more of their real email filtered into spam.

There’s also the trust side. People are more careful with their data now. They check app permissions and compare which phone better protects their privacy, much like this Android versus iPhone privacy breakdown does. Customers bring the same care to their inbox. A business that protects its email shows them it takes their safety seriously.

A simple plan for this week

You don’t need an IT team to get this done. Here’s a plan you can follow in short sessions:

• Day 1: list every tool that sends email for your business.
• Day 2: check or create your SPF record with all of them in it.
• Day 3: turn on DKIM in your email provider.
• Day 4: create a DMARC record with p=none and a reporting address.
• Weeks 2 to 6: read your reports, fix failing senders, then move to quarantine and reject.

That’s it. Under an hour of work spread over a few days, plus a few weeks of watching.

You lock your shop every night without thinking about it. Your email deserves the same habit. Once the locks are in place, the strangers stay outside, and your real messages get where they’re going.