Website security guide

Can someone send email pretending to be my business?

Yes, unless two small DNS records are in place. This is one of the most common gaps a Feli-Scan finds, and one of the cheapest to fix.

What SPF and DMARC do

SPF lists the servers allowed to send email for your domain.
DMARC tells receiving mail servers what to do with email that fails those checks: report it, quarantine it, or reject it, and where to send reports.

Without them, a forged invoice or password-reset email in your name can land in your customers’ inboxes looking exactly like the real thing.

List every service that sends email as you: your mailbox provider, your website, your invoicing and marketing tools.
Publish one SPF record that includes all of them.
Publish DMARC at p=none with a reporting address, and read the reports for two to four weeks.
Fix any legitimate sender that fails, then move to p=quarantine, then p=reject.

Questions people actually ask

It is the right first step because it tells you who sends as you. It does not stop forged email being delivered; only quarantine or reject does that.

Ask us directly. We answer these on calls all day.