Email security for small businesses

Email is how most small businesses send quotes, invoices and payment details, which is exactly why scammers like to imitate it. A fake message that looks like it came from your domain can cost your customers money and cost you their trust.

A few DNS records and good account habits make that much harder. The guides below cover each one.

Why does email security matter for a small business?

Two of the most common scams start with email. Phishing tricks people into clicking a link or sharing a password. Business email compromise uses a real or convincing fake business address to request payments or change bank details.

Protecting your own domain helps on both fronts. It stops scammers borrowing your name, and it helps your real email land in the inbox instead of spam.

How do SPF, DKIM and DMARC work together?

Think of them as three layers. SPF is a list of the services allowed to send email for your domain. DKIM adds a digital signature to each message so receivers can tell it wasn't altered. DMARC checks that one of those passes for the domain in the From address, then tells providers what to do when it doesn't: deliver, send to spam, or reject.

Our guide to SPF, DKIM and DMARC explained walks through each record with examples. Large inbox providers now expect them, too. Google's email sender guidelines require anyone who sends more than 5,000 messages per day to Gmail accounts to set up SPF, DKIM and DMARC.

How do I stop someone spoofing my business email?

The short version: publish one SPF record, turn on DKIM with your email provider, and add a DMARC record starting at p=none. Watch the reports for a few weeks, then tighten the policy so fake messages go to spam or get blocked.

Follow how to stop email spoofing for the full process. If your scan flagged DMARC, the fix guide for DMARC policy not enabled has the exact record to add, and our GoDaddy DMARC guide covers that provider click by click.

What about Google Workspace and Microsoft 365?

Both providers handle the heavy lifting, but a few settings are up to you. DKIM has to be switched on in your admin console, SPF and DMARC are added at your DNS host, and every account should use two-step sign-in (MFA).

If your team uses Google, our Google Workspace security guide lists the settings worth checking first.

Where should I start?

Check what your domain publishes today. The free DMARC checker shows your policy and what it means, and the SPF checker catches duplicate records and lookup limits. To check everything at once, including DKIM on common selectors, run the free website security scan.