Email security

A client says your invoice landed in spam, or someone has told you to set up DMARC. Email security for a small business starts with three DNS records that cost nothing: SPF, DKIM and DMARC. Do them before you buy anything. Budget about an hour for the DNS work and two months for the tightening, our estimate from counting the steps.

Do the records in this order, and DMARC last

List every service that sends as your domain, publish SPF, switch on DKIM, then add DMARC at p=none, which changes nothing about delivery. Anything you left off the list fails once DMARC is strict, so the strict part comes last. The copy-paste records for Microsoft 365 and Google Workspace are on their own page.

The one thing to pay for is reading the reports

DMARC reports are XML files, so you want a tool. If your DNS is on Cloudflare, its DMARC Management is free on all plans. If it isn’t, use EasyDMARC rather than move your DNS. The free option comes first when you qualify.

Ignore deadlines, and any gateway you don’t need yet

The standard suggests p=none for at least a month, then p=quarantine for as long again, before p=reject. Going to reject while a real sender is still failing is how invoices and password resets stop arriving, so don’t let a deadline rush that step. Hold off on a filtering gateway until your provider’s own filtering is switched on: a gateway is one more thing your mail passes through, and one more sender to get right.

These records protect your name, not your inbox

They stop strangers sending as your exact domain. They don’t stop a lookalike domain emailing your bookkeeper a new bank account. For that, make every bank change wait for a phone call, which costs nothing and can start today.