Check your company's email security records in ten minutes

A lot of the fraud that hits manufacturers starts with an email that looks like it came from you: a fake invoice to a customer, or a “new bank details” note to your accounts payable team. Three DNS records decide how easy that is for an attacker. You can read all three yourself.

What you need

A terminal, or any free web-based DNS lookup. The examples use dig on macOS or Linux; on Windows, nslookup -type=TXT works the same way.

1. SPF: who is allowed to send as you

$ dig +short TXT example.com
"v=spf1 include:spf.protection.outlook.com include:_spf.example-crm.com -all"

SPF lists the services allowed to send mail for your domain. Check two things:

• Every service that sends as you is listed: your email provider, your CRM, your ERP’s invoice emails, your website’s contact form. Missing ones will have their mail rejected or sent to spam.
• How it ends. -all means “reject anything else.” ~all means “accept but mark as suspicious.” ?all or +all mean SPF isn’t really protecting you.

You can have only one SPF record. Two v=spf1 records break both.

2. DKIM: proof the message wasn’t changed

DKIM keys live at a name your email provider chose, so you need to know the “selector.” For Microsoft 365 it’s usually selector1 and selector2:

$ dig +short CNAME selector1._domainkey.example.com
selector1-example-com._domainkey.example.onmicrosoft.com.

If that comes back empty, DKIM signing may not be turned on. In Microsoft 365 it’s a switch in the Defender portal; Google Workspace has the same setting in the Admin console.

3. DMARC: what to do with mail that fails

$ dig +short TXT _dmarc.example.com
"v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

DMARC tells receiving mail servers what to do when a message fails SPF and DKIM. The p= value is what matters:

Value	What it means
p=none	Do nothing; just report. Spoofed mail still gets delivered.
p=quarantine	Send failing mail to spam.
p=reject	Refuse failing mail entirely.

No record at all is the same as p=none. Plenty of companies sit at p=none for years because nobody owns the next step.

Getting to p=reject without breaking things

Don’t jump straight to p=reject. Turn on reporting (rua=) first, read the reports for a few weeks to find every legitimate service sending as you, fix their SPF and DKIM, then go to quarantine, then reject.

If you want a second set of eyes on your records, email and DNS security is part of every External Attack Surface Assessment.