Invoice fraud usually starts with an email that seems to come from a familiar sender: a supplier, a client or the company's director. It asks for an invoice to be paid to a new account or for an urgent payment. A sender address that looks right proves nothing.
Three settings that work together
You don't need to know how they work technically. It's enough to know they're in place on your domain.
- SPF is a list of servers allowed to send email in your name.
- DKIM is a digital stamp that proves the email wasn't changed on the way.
- DMARC is a rule that tells other companies' email servers what to do with an email that fails the first two checks: let it through, send it to spam, or reject it.
What to ask your IT partner
- Do all our domains have SPF, DKIM and DMARC set up? Including the ones we don't send email from?
- What is our DMARC rule? If the answer is
p=none, the rule only monitors and doesn't protect. - When can we move to
p=quarantineorp=reject?
Domains you don't send email from
Fraudsters like to use old or unused domains because nobody watches them. They need just two records: an SPF record that allows no senders, and a DMARC rule that rejects all email.
Check your domain
Our free check shows in a few seconds whether email can be forged in your domain's name. It doesn't check your website.