Email Security (SPF, DKIM & DMARC) Compliance Check

Why this matters

Email is still the most common route for fraud and data breaches against UK businesses. SPF, DKIM and DMARC are three DNS-based standards that let receiving mail servers verify that a message really came from your domain. Without them, criminals can send convincing emails that appear to come from you, whether invoice-fraud requests to your customers or phishing messages to your own staff. The National Cyber Security Centre recommends all three for every organisation that sends email, and major mailbox providers such as Google and Microsoft now expect bulk senders to authenticate their mail or risk it being filtered or rejected.

There is a legal angle too. Article 32 of the UK GDPR requires you to implement appropriate technical and organisational measures to keep personal data secure, and the ICO treats basic protections such as email authentication as part of reasonable security. A spoofed-email incident that exposes personal data can become a reportable personal data breach, and a lack of basic controls weakens your position with the ICO. Many cyber insurers and Cyber Essentials assessors also ask about email protection. Setting up the standards is usually quick and low cost, though DMARC in particular needs care so that legitimate mail from marketing and invoicing tools is not blocked.

What you'll need

• The domain name(s) your business sends email from
• A list of services that send email as your domain (mail provider, newsletter, invoicing, CRM, helpdesk)
• Access to your DNS settings or the person who manages them
• Any existing SPF, DKIM or DMARC records, if you know them

What you'll get

A personalised compliance report covering: a score out of 100, an executive summary, a list of findings ranked by severity, and a prioritised action plan with timeframes.