No SPF and no DMARC — email spoofing unprotected

Email has no built-in sender verification: any server can send a message with your address in the From line. SPF and DMARC are the two DNS records that tell receivers which servers may send for you and what to do with everything else. Without either, a receiver has no way to tell a forgery from the real thing.

For a young company this is the attack with the best effort-to-damage ratio: a mail “from the founder” to the accountant, an “invoice” to a customer — and to the outside world the sender is you. There is an everyday cost as well: large providers increasingly treat mail from domains without these records as spam.

Check it yourself: `dig TXT your-domain.com +short` should show a line starting with `v=spf1`, and `dig TXT _dmarc.your-domain.com +short` one with `v=DMARC1`. Your mail provider (Google Workspace, Microsoft 365, …) documents both in a few-minute setup.