Email Security (SPF, DKIM & DMARC) Compliance Check

Email is still the most common route for fraud and data breaches against UK businesses. SPF, DKIM and DMARC are three DNS-based standards that let receiving mail servers verify that a message really came from your domain. Without them, criminals can send convincing emails that appear to come from you, whether invoice-fraud requests to your customers or phishing messages to your own staff. The National Cyber Security Centre recommends all three for every organisation that sends email, and major mailbox providers such as Google and Microsoft now expect bulk senders to authenticate their mail or risk it being filtered or rejected.

There is a legal angle too. Article 32 of the UK GDPR requires you to implement appropriate technical and organisational measures to keep personal data secure, and the ICO treats basic protections such as email authentication as part of reasonable security. A spoofed-email incident that exposes personal data can become a reportable personal data breach, and a lack of basic controls weakens your position with the ICO. Many cyber insurers and Cyber Essentials assessors also ask about email protection. Setting up the standards is usually quick and low cost, though DMARC in particular needs care so that legitimate mail from marketing and invoicing tools is not blocked.

This check reviews your SPF, DKIM and DMARC setup and related email security controls, helping you reduce spoofing risk and support your UK GDPR security obligations.