What each check means
- Impersonation protection (DMARC) tells receiving servers to refuse or junk mail that claims to be from you but fails authentication. It's the one that actually stops spoofing.
- Approved senders list (SPF) lists the servers allowed to send as your domain.
- Digital signature (DKIM) cryptographically signs each message so it can't be forged or altered.
- Enforced encryption (MTA-STS) makes other mail servers encrypt mail they deliver to you.
- Encryption reporting (TLS-RPT) sends you a report when encrypted delivery fails, so problems get caught early.
Why this is urgent now
Business email compromise is consistently one of the costliest crimes the FBI's Internet Crime Complaint Center tracks, and it rarely involves hacking anything. The attacker just sends email that looks like it came from you. For healthcare practices, dealerships, law firms and CPA firms, that usually means a fake invoice, a changed bank account, or a request for patient or client records.
At the same time, Google, Yahoo and Microsoft now expect senders to have SPF, DKIM and DMARC in place, and mail from domains without them is more likely to land in spam.
What happens when you ask for a fix plan
- A technician reviews your results and the services your business sends from.
- You get a written plan within one business day: each change, why it matters, and the order we'd make it in.
- If you want us to do the work, we make the changes remotely, with no email downtime, and monitor the reports afterward.
