Ask most business owners where their biggest cyber risk sits and they point to ransomware, or to the firewall. Ask an incident responder and the answer is usually quieter: someone received an email, believed it, and acted on it. Email is the front door to a small or mid sized business, and it is where most attacks begin.
This guide covers what the main email threats look like in practice, the three DNS records that stop criminals from sending mail as your domain, and the order we follow when we lock down a mailbox environment for a client in Toronto and the GTA. None of it needs new software. Most of it is configuration and a few habits.
Why email is still where attacks start
Email works for attackers because it is cheap, it scales, and it reaches a person directly. A message can be sent to ten thousand people for almost nothing, and it only has to fool one. Filters have improved, but attackers adapt just as quickly, so a protection plan has to assume that some bad messages will reach an inbox.
The cost of getting this wrong is well documented. Two annual studies give a useful picture, and both are worth treating as averages rather than predictions for your own business.
The gap between the first two figures is the point. A breach that starts with a phishing email costs more than the typical breach, partly because the attacker arrives with a real login and can move quietly before anyone notices.
Spoofing, phishing and business email compromise
These three terms get used interchangeably, but they are different problems with different fixes.
Phishing is a message designed to get a click or a password. It imitates a bank, a courier, a supplier or Microsoft 365 itself, and the better ones look completely routine. The aim is usually a stolen login, which then opens the mailbox, the shared drive and anything else that account can reach.
Spoofing is when someone sends email that appears to come from your domain. Your customers and your own staff trust it because the name is yours. Without the right DNS records, nothing stops a stranger from doing this, and you may never see it happen because the mail never touches your systems.
Business email compromise, or BEC, is the most expensive of the three. It is a believable request to change bank details or pay an invoice, sent from a spoofed lookalike domain or from a mailbox the attacker has already taken over. There is no attachment and no link, so there is nothing for a filter to catch. It succeeds because it looks like ordinary work.
Picture a bookkeeper who receives an email, apparently from a regular supplier, saying their bank account has changed. The invoice is real and the amount is normal, so the payment goes out the same day. Nothing looks wrong until the real supplier phones about the missed payment. This shows how BEC works, and is not a description of any one client.
How SPF, DKIM and DMARC fit together
These three records live in your domain’s DNS, and together they let a receiving mail server check whether a message really came from you. Each one answers a different question.
SPF lists the servers that are allowed to send email for your domain. DKIM adds a digital signature to each message, so the receiver can confirm the content was not altered on the way. DMARC ties the two together and tells receivers what to do when a message fails: deliver it anyway, send it to spam, or reject it. It also sends you reports, which is how you find out who is really sending mail as your domain.
DMARC is the record that makes the other two enforceable, and it is where most businesses stall. The safe way in is to start by only watching, then tighten the policy in stages as the reports confirm your own mail is passing.
| DMARC policy | What happens to fake mail | When to use it |
|---|---|---|
| p=none | Delivered, but you receive reports | The first few weeks, while you find every legitimate sender |
| p=quarantine | Sent to spam | Once the reports show your real mail passes |
| p=reject | Blocked before delivery | The goal: full protection against spoofing of your domain |
A word on timing. Moving straight to reject without watching the reports is the classic mistake, because the invoicing system or the newsletter tool nobody remembered gets blocked along with the criminals. It is also worth knowing that large mailbox providers now expect bulk senders to publish these records, so having them in place helps your genuine mail reach inboxes too.
Our free email security check looks up your SPF, DKIM and DMARC records and tells you in plain language what is missing.
Run the email security checkThe order we work in
When we lock down email for a client, the sequence matters more than any single setting. We begin with an audit of every system that sends mail as the domain: Microsoft 365, the website contact form, the invoicing platform, the CRM and any newsletter tool. Anything missed at this stage is what breaks later.
Next we publish SPF and turn on DKIM signing for each of those senders, then add DMARC in monitor mode with a reporting address. We read the reports for a few weeks, fix whatever is failing, and only then move to quarantine and finally reject. Alongside the DNS work we add anti phishing filtering, attachment scanning and multi factor sign in on every mailbox, because a stolen password should never be enough on its own.
The habits that settings cannot replace
Technical controls stop the bulk of the noise. The remaining risk is a convincing message that reaches a person, and for that the defences are habits.
- Verify payment changes by phone, using a number you already had on file and never one from the email.
- Report suspicious mail through a one click button, so nobody has to work out who to tell.
- Train with real examples in short, regular sessions. They work better than one annual video.
- Review mailbox forwarding rules, since attackers often leave a hidden rule that copies mail to an outside address.
If you only change one thing this month, make it the first: a simple rule that no bank detail changes on the strength of an email alone. It costs nothing and it closes the door that business email compromise depends on.
Questions we hear often
Will DMARC block my own newsletters or invoices?
Only if they are not authorized in SPF or DKIM. That is why we start in monitor mode and review the reports before enforcing anything.
Is Microsoft 365 or Google Workspace protection enough?
They provide a solid base, but the DNS records for your domain are yours to configure, and extra filtering and training close further gaps.
How long does a proper rollout take?
A typical small business moves from audit to enforced DMARC in four to eight weeks, most of it spent watching reports.
What should I do if I think someone has been phished?
Change the password, sign the account out everywhere, check forwarding rules, and tell your IT provider right away so the scope can be checked.
If you would like a second opinion on your setup, take our IT risk assessment for a wider view, or talk to our Toronto team about securing your email.
Related service: Cyber Security Assessment
Last updated
