Stop scammers emailing as you - for free
If you have your own domain - hello@yourbusiness.co.uk - anyone can forge emails that look like they came from you. That’s how fake-invoice and “it’s the boss, pay this now” scams work. Three small DNS records shut most of it down, your email provider hands them to you, and it costs nothing. A paid “DMARC service” automates the watching - it doesn’t give you protection you can’t set up yourself.
The three records, in one line each
SPF - the list of servers allowed to send email for your domain. DKIM - a tamper-proof signature on your outgoing mail, proving it’s really from you. DMARC - the rule that tells other mail servers what to do with a fake, and sends you reports. That’s the whole toolkit. All three are open internet standards published by the IETF, not any one company’s product, which is why every mail provider supports them.
dmarc.org · how DMARC works →RFC 7489 · DMARC →RFC 7208 · SPF →RFC 6376 · DKIM →Turn on SPF and DKIM - your provider gives you the records
Whoever runs your email - Google Workspace, Microsoft 365, Proton, your web host - has a help page with the exact SPF and DKIM records for your domain. Copy them into your domain’s DNS settings (wherever you bought the domain, or your DNS provider). This is most of the protection, and it’s a copy-paste job. Search “[your provider] add SPF DKIM”.
Add a DMARC record - start gentle
Add one more DNS record to switch DMARC on in watch-only mode, so it can’t break anything yet:
v=DMARC1; p=none; rua=mailto:you@yourdomain
p=none means “don’t block anything, just report.” You’ll tighten it once you can see what’s going on.
Actually read the reports - free
DMARC reports arrive as unreadable XML. Point them at a free reader - Postmark’s free DMARC tool emails you a plain-English weekly summary - and suddenly you can see who’s sending mail as you: your real services, and anyone forging you.
Postmark · free DMARC reports →Tighten it over a few weeks
Once the reports show your genuine mail (and any newsletters or tools you send through) passing, step DMARC up: from none (watch) to quarantine (fakes go to spam) to reject (fakes bounced). Don’t jump straight to reject, or you’ll block your own mail before you’ve spotted everything legitimate. The big providers all recommend this gentle climb.
Setup vs monitoring - what you’d actually be paying for
Two halves. Setup - publishing SPF, DKIM and DMARC - is free: your provider gives you the records, you paste them in. Monitoring - reading the reports and managing the climb to “reject” - is the ongoing part. Paid services like EasyDMARC or Sendmarc automate that. Genuinely useful if you send mail through lots of systems or have no time to watch - but a sole trader or small team with one mail provider doesn’t need it. A free digest covers the monitoring for a simple setup.
What this doesn’t stop
This stops people forging your exact domain. It won’t stop a look-alike (yourbusiness-invoices.com), and it won’t help if your actual mailbox gets hacked. For those, the rule is simple: treat a surprise invoice or a changed bank detail as guilty until a phone call - to a number you already had, not one in the email - proves otherwise.
Last checked: 11 October 2026. Tell us if anything here has drifted.