What it is
In plain words, before anything else.
Email was built without a way to prove who sent a message. Two settings fix that. SPF lists the servers allowed to send as you. DMARC tells everybody else what to do with mail that fails the test, and only a policy of quarantine or reject actually stops anything.
The common half measure is SPF plus a DMARC policy set to none, which watches the fraud happen and reports on it. It is a real step, and on its own it stops nothing.
What it costs you
The loss you never see happen.
This is the mechanism behind fake invoice fraud. A message from your address, on your letterhead, asking a customer to pay to a different account. The customer pays. They then blame you, and they are not entirely wrong.
It also decides whether your genuine mail is trusted. Domains without it get filtered harder, so your own invoices land in spam.
Check it yourself
Do not take our word for it. Look.
This takes about a minute, costs nothing, and needs no account with us or anybody else. A finding you have confirmed with your own eyes is the only kind worth acting on.
- 1
Ask any DNS lookup site for the TXT records on your domain and look for one starting v=spf1. That is SPF.
- 2
Then look up the TXT records on _dmarc.yourdomain.com. A record starting v=DMARC1 is there or it is not.
- 3
If it is there, read the p= part. p=none means nothing is being stopped. p=quarantine or p=reject means it is working.
What we found
Out of 186 businesses we checked ourselves.
- 145 of 186
could still have mail sent in their name that lands in a real inbox. One hundred and nineteen of those had started the work and stopped before it counted. Forty one had finished it properly.
Counted from our own checks of 186 real businesses, measured on 2026-09-10, one count per business. No business is named and none of their reports is public. The full write ups are in what we found.
How we fix it
What we do, and what we leave alone.
We give you the exact records to add and check the result, and we tell you honestly that moving to an enforcing policy needs a short watching period first so your own mail does not get caught.
This is the item on the list that most often makes an owner go quiet for a second. It should.
Next
The checks closest to this one.
- V4
Proving that something really came from your business
An invoice from you and a convincing fake from somebody else look exactly the same to the person holding one. - V2
Stopping somebody from quietly pointing your address somewhere else
Every visit starts by asking where your website lives. Without protection, that answer can be forged. - V5
Your licence is real. Can anybody check it without ringing you?
A photograph of a certificate proves nothing. Anybody can make one in a minute.
Is this one open on your site?
The free check runs all sixteen against your own address and tells you which came back clean, in the same plain words as this page.
Free. No signup. Takes about a minute.