The email looks like yours. But it isn’t! Someone’s impersonating you!
If you send bank details, invoices or sensitive information by email, the way your domain is configured matters.
Imagine a customer receives an email that looks as though it came from your company. The name is right, it mentions an outstanding invoice and says you’ve changed your bank account.
There’s just one problem: you didn’t send that email, and that IBAN isn’t yours.
One simple rule can save you a nasty surprise: if an email tells you a supplier has changed their bank account, always call them on their usual number and confirm it before paying.
Email is an everyday service. That doesn’t make it a simple one.
Behind every account is infrastructure that sends, receives and validates messages. And not all email services offer the same level of security.
If your business depends on email, don’t leave it to chance.
Microsoft and Google have some of the most advanced email infrastructure available. But choosing a good provider isn’t enough: the way your domain is configured matters too.
Here comes the jargon: SPF, DKIM and DMARC
SPF helps specify which servers can send email on behalf of your domain.
DKIM adds a digital signature to messages so the receiving server can check their authenticity and detect possible tampering.
DMARC tells receiving servers how to handle messages when these checks don’t add up.
None of these measures makes fraud impossible. But configured properly, they make it much harder for someone to impersonate you by email.
An email wants to get in.
“I’m an email from company.com”
Three pieces working together
- SPFThe list
- Is this server allowed to send email for this company?
- DKIMThe signature
- Does this email carry the correct digital signature?
- DMARCThe rules
- If something doesn’t add up, what should we do?
Checks the results and decides.
- Everything checks out
- The email can continue.
- Something doesn’t add up
- It may flag, quarantine or reject the email, depending on the rules and configuration.
These aren’t three magic locks, and they don’t make fraud impossible. They help detect someone impersonating a domain. Passing the checks doesn’t guarantee an email is legitimate; a single failed check doesn’t mean it must be rejected.
A useful detail about DKIM
DKIM stands for DomainKeys Identified Mail.
So, what now?
If you send invoices, bank details or sensitive information by email, don’t assume your domain is properly protected.
If you’re not sure how your email is configured or would like us to review your domain’s protection, Let’s talk →
At SAV we’ve worked with Microsoft email solutions since 2003, when Exchange was already part of our day-to-day work.