Email and Microsoft 365
How to stop criminals sending email as your business
Anyone can send an email that claims to be from your business. Three settings let receiving mail systems check whether it really is.
1 min readExplainer
The short version
Three settings, SPF, DKIM and DMARC, tell the world which email really comes from your business. They also keep your mail out of spam folders.
The problem
Email was designed in a more trusting era. The “from” address on a message is just text, and nothing in the original design stops a criminal typing your business name and address there. Customers and vendors may receive invoices that appear to come from you.
The three settings
They are records published with your domain name, which receiving mail systems check:
- SPF lists the services allowed to send email for your domain, such as Microsoft 365 and your invoicing system.
- DKIM adds a digital signature to every message you send, proving it was not changed on the way.
- DMARC tells receiving systems what to do with mail that fails those checks: let it through, send it to spam or reject it. It can also send you reports about who is sending in your name.
Why it also affects whether your mail arrives
Large email providers now expect these settings from businesses that send to their users. Without them, your legitimate messages are more likely to land in spam.
What to check
- Do all the services that send email for you (your website, invoicing, marketing tools) appear in your SPF record?
- Is DKIM turned on in Microsoft 365?
- Do you have a DMARC record, and has it moved from monitoring only toward rejecting fake mail?
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.