The 3-2-1 backup rule: how to survive ransomware and hardware failure
Most companies have backups — until the day they need to restore. Here is a simple, proven model that keeps your data recoverable.
Read articleBusiness email compromise is one of the most expensive types of cybercrime. Attackers send an email that looks like it comes from your company — a new bank account for an invoice, an urgent payment request from the director — and someone pays. Very often this works because the company domain is not protected against spoofing.
The three records that protect your domain
SPF — who is allowed to send
SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send email for your domain, for example your mail provider and your CRM. A typical record looks like v=spf1 include:_spf.example.com -all. The -all at the end tells receivers to reject everything else.
DKIM — a digital signature
DKIM adds a cryptographic signature to every outgoing message. The receiving server checks it against a public key published in your DNS. If the message was forged or modified along the way, the signature will not match.
DMARC — the policy and the reports
DMARC ties SPF and DKIM to the address the recipient actually sees in the From field, and tells receivers what to do with messages that fail: p=none (only monitor), p=quarantine (send to spam) or p=reject (block). DMARC also sends you reports showing who is sending email using your domain.
A safe rollout plan
- Inventory every service that sends email for you: mail server, website forms, CRM, accounting, marketing tools.
- Publish an SPF record that includes all of them.
- Enable DKIM signing with your mail provider and in each service.
- Start DMARC with
p=noneand a reporting address; analyze the reports for 2–4 weeks. - Fix legitimate sources that fail, then move to
p=quarantineand finallyp=reject.
Jumping straight to
p=rejectwithout analysis can block your own invoices or website notifications. Go step by step.
Bonus: better deliverability
Major providers such as Gmail and Outlook now expect SPF, DKIM and DMARC from business senders. A correctly configured domain is not only safer — your legitimate emails are also less likely to end up in spam.
CySec configures email security (SPF/DKIM/DMARC) as part of our Office & Business IT solutions, including report analysis and a safe transition to an enforcing policy.