The Attack That Doesn’t Need to Hack Anything
Here’s an uncomfortable fact about how email actually works: unless you’ve specifically told the internet otherwise, anyone can send a message that appears to come from your company’s domain. No password required, no breach, no malware. They just type your domain into the “from” field and hit send. Whether that message gets flagged as fake or lands in an inbox looking completely legitimate depends entirely on three technical records most small businesses have never configured: SPF, DKIM, and DMARC.
This isn’t a new problem, but it’s gotten a lot more attention recently because Google and Yahoo tightened their bulk sender requirements, and the gap between who’s protected and who isn’t has turned out to be enormous. Recent research tracking nearly a million domains found that while a growing share now publish some form of DMARC record, only about 1 in 11 actually meet the full best practice standard of enforcement plus reporting. Mid-market and small businesses lag well behind large enterprises here, and the businesses getting impersonated in phishing campaigns are disproportionately the ones that never finished the setup.
What These Three Records Actually Do
SPF tells receiving mail servers which servers are allowed to send email on your domain’s behalf. DKIM adds a digital signature so a message can be verified as unaltered in transit. DMARC ties the two together and tells receiving servers what to do when a message fails those checks, ignore it, quarantine it, or reject it outright.
The trouble is that most domains stop at the easiest step. They publish a DMARC record set to “p=none,” which does nothing but monitor, it doesn’t block a single spoofed email from reaching anyone. Getting from monitoring to actual enforcement, “p=quarantine” or “p=reject,” is the step that provides real protection, and it’s the step most small businesses never take because nobody circles back to finish it.
Why This Matters More Than It Sounds Like It Should
A properly enforced DMARC policy does two things at once. It stops attackers from sending convincing phishing emails that appear to come from your own domain, the kind that fool employees and customers alike because the “from” address looks exactly right. It also protects your ability to actually reach inboxes: Google and Yahoo now weight authentication status heavily in spam filtering decisions, so an unauthenticated domain increasingly finds its own legitimate marketing and transactional email getting filtered or blocked.
Getting this configured correctly is exactly the sort of unglamorous, high impact task that belongs in ongoing operational management work rather than a one time project. Records need monitoring after they’re set up too. A business that changes email providers or adds a new marketing tool without updating its SPF record can accidentally break its own legitimate email, which happens more often than the spoofing risk that started the project in the first place.
The Fix Is Cheap. The Setup Just Needs to Get Finished
The good news here is real: none of this requires new software or ongoing licensing costs, it’s a DNS configuration change and some monitoring going forward. The bad news is that most businesses either never started or stopped at the monitoring only stage and assumed the job was done. A few practical steps for any Massachusetts business that hasn’t checked this recently:
- Confirm SPF, DKIM, and DMARC records all exist and actually match your current email sending sources, old records referencing a discontinued vendor cause real problems.
- Move your DMARC policy from monitoring only to enforcement in stages, quarantine first, then reject, watching reports along the way.
- Set a recurring review, quarterly is reasonable, so a new tool or vendor doesn’t quietly break what’s already working.
Ready to Close This Gap?
Schedule a free security assessment with Cloud9 and we’ll check your domain’s current authentication status, tell you exactly where it stands, and fix what’s missing.