Anyone can send email as you. Here's why

Email was designed long before anyone worried about fakes. When a message arrives, the "from" line is just text the sender typed. Nothing in the original design checks it.

That's how someone can send your customers an invoice that looks like it came from you.

The three records that fix it

Your domain can publish three short notes in its DNS, the public address book for your domain. Mail servers read them before they trust a message.

• SPF lists the services allowed to send email for your domain, like your email provider and your newsletter tool.
• DKIM adds a signature to every message, so a mail server can tell it really came from you and wasn't changed on the way.
• DMARC tells mail servers what to do with a message that fails those checks, for example put it in spam or reject it, and where to send reports.

With all three in place and DMARC set to quarantine or reject, a fake message from your domain ends up in spam or bounces.

Why it goes wrong

Most domains have SPF but no DMARC, or DMARC set to "none", which only watches and never blocks. Others list too many services in SPF and break the limit on lookups, so the record stops working.

A domain that never sends email is not safe by default either. Mail servers judge the domain in the "from" line, not whether it has a mailbox, so a quiet domain with no rules is an easy one to fake, and you never see the bounces. It takes three records to close it. A DMARC rule set to reject, an SPF record that allows no senders (v=spf1 -all), and an empty mail server record (0 .).

A scan reads these records the same way a mail server does, so it can tell you exactly which one is missing or weak.