Protection against email fraud

What we check

We query the public DNS records of the domain:

• MX: whether the domain receives emails and at which provider, such as Microsoft 365, Google Workspace, Infomaniak or Hostpoint.
• SPF: whether a record defines which servers may send emails in the name of the domain.
• DMARC: whether a record defines what should happen to forged emails, and how strict it is.
• DKIM: whether a key for digital signatures is stored under one of the common names.

If SPF or DMARC is missing, this is a serious defect. If DMARC is set to p=none, there is a warning. If we find no DKIM, a note, because DKIM can also be under a name we do not know.

Why it matters

Email was invented without sender verification. Anyone can send an email with the sender accounting@example.ch, just as easily as you can write any sender on an envelope.

Fraudsters exploit this deliberately:

• Forged invoices with a changed IBAN go to the customers.
• Payment requests "from the boss" go to the accounting department.
• Phishing emails in the company's name damage its reputation.

SPF, DKIM and DMARC give the receiving mail server the means to recognise and reject such forgeries. Since 2024 Google and Yahoo also require SPF, DKIM and DMARC from bulk senders. Without these records the domain's genuine emails are also more likely to end up in spam.

How to fix it

You create the records at the provider that manages the DNS records of the domain, usually the domain or hosting provider.

1. SPF

A TXT record on the domain. The email provider names the exact content. Example for Microsoft 365:

v=spf1 include:spf.protection.outlook.com -all

Include all services that send in the name of the domain, such as newsletter tools or online shops. There may be only one SPF record per domain.

2. DKIM

Activate DKIM in the administration of the email provider. It shows one or two records that are entered in the DNS.

3. DMARC

A TXT record on _dmarc.example.ch. Start in monitoring mode:

v=DMARC1; p=none; rua=mailto:dmarc@example.ch

The reports to the address given show who sends in the name of the domain. When all genuine senders pass SPF or DKIM, tighten to p=quarantine (into spam) and later to p=reject (reject). Only then is the domain really protected.

How to check it yourself

In a Gmail account, open an email that comes from the domain and choose "Show original" in the menu. At the top are the results for SPF, DKIM and DMARC. Services such as mxtoolbox.com check the records of a domain directly.

Frequently asked questions

Can genuine emails get lost because of DMARC?

Yes, if a service that sends in the name of the domain is not in the SPF record, such as a newsletter tool or the accounting software. That is why you start with "p=none", evaluate the reports and only then tighten.

No emails are sent through the domain. Is anything still needed?

Especially then it is worthwhile: with "v=spf1 -all" and a DMARC rule "p=reject" it is declared that no emails come from this domain. Forgeries are then rejected.

What are SPF, DKIM and DMARC in one sentence?

SPF names the servers that may send for the domain. DKIM signs every email digitally. DMARC tells the recipient what should happen to emails that pass neither.