Run a mail authentication check against almost any Egyptian SME domain and you will find the same picture: SPF present but wrong, DKIM not signing, DMARC absent entirely.
Two consequences follow, and one of them is expensive.
Consequence one: your legitimate mail gets filtered
Receiving mail servers score inbound messages on whether they can verify the sender. A domain with no authentication records looks, to a spam filter, exactly like a domain being spoofed.
So your quotations land in junk folders and nobody tells you. You conclude the customer is ignoring you.
Consequence two: anyone can send email as you
This is the serious one.
Without a DMARC policy, nothing stops a stranger from sending mail that lands in your customer's inbox with your domain in the From line, looking exactly like it came from your finance director.
The standard attack writes to your customer, references a real outstanding invoice, and asks them to update the bank details for payment. It works because the email really does look like it came from you, and because the amount and the invoice number are correct.
The customer pays the wrong account. Then there is a commercial argument about whose loss it is, and the answer is often not the one you would hope for.
What the three records do
SPF lists which servers are allowed to send mail for your domain. A receiving server checks the sending IP against that list.
DKIM cryptographically signs outgoing mail with a key published in your DNS. The receiver verifies the signature, which proves the message was not altered and did come from an authorised sender.
DMARC tells receivers what to do when SPF and DKIM fail (let it through, quarantine it, or reject it) and where to send reports about it. Without DMARC the first two are advisory.
How to do it without breaking your own mail
The failure mode people fear is real: publish a strict DMARC policy before you know every legitimate sender, and your own newsletters, invoicing system or CRM start bouncing.
So do it in stages:
- Publish SPF, listing every service that sends on your behalf: mail platform, CRM, invoicing, marketing tool, monitoring alerts.
- Enable DKIM signing on your mail platform. Most make this two clicks and a DNS record.
- Publish DMARC at
p=nonewith a reporting address. This changes nothing about delivery and starts giving you data. - Read the reports for a few weeks. You will find legitimate senders you had forgotten. Add them.
- Move to
p=quarantine, thenp=reject, once the reports are clean.
The whole sequence is a few hours of work spread over a month, most of it waiting.
Why it stays undone
Because it is invisible. Nothing is obviously broken, no user complains, and it appears on no audit until a customer's security questionnaire asks.
We check it free for anyone who asks. It takes us an afternoon, and nothing we do is worth more at the start of a relationship. If yours is missing, and it probably is, better to know today than after the fraudulent invoice.
