The SME Security Brief - Issue #10

You're reading The SME Security Brief, practical IT, cyber security and technology advice for Irish and UK businesses. No jargon. No scare tactics. Just what you need to know, every week.

If someone forwarded this to you, you can subscribe at thesmesecuritybrief.com.

Imagine your biggest client receives an email. It appears to come from your email address, your name, your domain, your email signature. It asks them to update their bank details for an upcoming payment. They do. The money goes to a criminal.

You never sent that email. You did not even know it happened.

This is called email spoofing, and it is one of the most common and damaging attacks affecting SMEs today. Attackers do not need access to your email account to send emails that appear to come from your domain. Without the right technical controls in place, anyone can send an email that looks like it came from you.

The three controls that prevent this are called SPF, DKIM, and DMARC. They are configured in your domain's DNS settings , the same place you set up your website and email. Many SMEs have never heard of them. Even fewer have all three properly configured.

Getting these right does two things: it stops criminals spoofing your domain to attack your clients and suppliers, and it improves the deliverability of your own legitimate emails, meaning fewer of your emails end up in spam folders.

What you should do this week:

These three acronyms sound technical but the concepts behind them are straightforward.

SPF , Sender Policy Framework
SPF is a list published in your domain's DNS that says: these are the mail servers that are allowed to send email from our domain. Any email that arrives claiming to be from your domain but sent from a server not on your list should be treated with suspicion.

Think of it as a whitelist for your outgoing mail. Without it, any mail server in the world can send email claiming to be from yourcompany.ie.

Setting it up: your IT provider or email provider (Microsoft, Google, etc.) will give you an SPF record to add to your DNS. It typically looks something like: v=spf1 include:spf.protection.outlook.com -all

DKIM , DomainKeys Identified Mail
DKIM adds a digital signature to every email your domain sends. The receiving mail server can verify that signature to confirm the email genuinely came from you and was not tampered with in transit.

Think of it as a wax seal on a letter. If the seal is broken or fake, the recipient knows something is wrong.

Setting it up: your email provider generates a DKIM key pair. You publish the public key in your DNS. Your email provider signs outgoing emails with the private key. Most modern email platforms including Microsoft 365 and Google Workspace handle this automatically once you add the DNS record.

DMARC , Domain-based Message Authentication, Reporting and Conformance
DMARC is the policy that ties SPF and DKIM together. It tells receiving mail servers what to do with an email that fails SPF or DKIM checks , either monitor it, quarantine it, or reject it outright. It also sends you reports showing who is sending email from your domain, which is how you find out if someone is spoofing you.

Think of it as the enforcement layer. SPF and DKIM check the email. DMARC decides what happens if it fails.

Setting it up: start with a DMARC policy of p=none to monitor without blocking, review the reports for a few weeks, then move to p=quarantine or p=reject once you are confident all your legitimate email is passing checks.

Recommended starting DMARC record:
v=DMARC1; p=none; rua=mailto:[email protected]

Replace [email protected] with an email address where you want reports sent. Your IT provider can help interpret them.

MXToolbox (mxtoolbox.com) is a free online tool that checks your domain's email security configuration in seconds. It requires no account, no software, and no technical knowledge to use.

Go to mxtoolbox.com, enter your domain, and run the following checks:

Each result is colour coded , green means pass, red means fail, yellow means there is something to review. It takes about two minutes to run all four checks and gives you a clear picture of where you stand.

If any checks come back red, take the results to your IT provider or domain registrar. Most of these records can be added or fixed in under an hour once someone knows what to do.

For Microsoft 365 users: Microsoft provides specific SPF and DKIM records for your domain as part of the Microsoft 365 setup process. If you set up Microsoft 365 with the help of a provider, these may already be in place , MXToolbox will confirm.

Five questions for your email security review:

SPF, DKIM, and DMARC are not glamorous. They live in a part of your DNS settings most people never look at. But they are the difference between a domain that criminals can freely impersonate and one that fights back.

If your clients or suppliers received an email that appeared to come from you asking them to change bank details, how would you even know? With DMARC reporting in place, you would. Without it, you would not.

That is a risk worth fixing this week.

See you next week.