Can someone send email pretending to be you?
For most small businesses the answer is yes, and nobody has ever told them. This checks the three DNS records that decide it (SPF, DKIM and DMARC) and tells you plainly what is missing.
Check a domain
What these three records do
SPF lists which servers are allowed to send email as your domain. Without it, anyone can.
DKIM signs your outgoing mail so receivers can prove it was not altered or forged in transit.
DMARC is the one that matters most and the one most often missing. It tells receiving servers what to do when a message fails the checks above, and sends you reports of who is trying to impersonate you. SPF without DMARC accomplishes very little.
The common failure is not "no security at all." It is a DMARC record set to
p=none, which only monitors. It looks configured, it reports problems, and it blocks
nothing. Spoofed invoices still land in your customers' inboxes.
Why this is worth ten seconds
Invoice fraud and "the boss needs gift cards" emails work because the message genuinely appears to come from a real company's domain. The fix is a DNS change, not a product you have to buy. But it has to be done in the right order, or you will start blocking your own legitimate mail.
Want Chris to look at your email?
He can fix the records in the right order, so your own mail keeps arriving. Call (870) 876-3016, text (870) 641-5054, or send a note.