DMARC

DMARC is the policy layer that ties SPF and DKIM together. It has three settings: none (just monitor), quarantine (send fakes to spam), and reject (block them entirely). It also sends you reports showing exactly who’s sending email as your domain — legitimate services you’d forgotten about, and scammers trying it on.

The trap: jumping straight to “reject” before checking that all your legitimate senders pass authentication. Do that and you’ll block your own emails. Start at “none”, watch the reports for a few weeks, then tighten gradually.

Google, Microsoft, and Yahoo all expect proper authentication from business senders now, and the Australian Cyber Security Centre recommends DMARC for every Australian business. Without it, your domain is open to spoofing — there’s a free 30-second check in that entry.