Set up SPF, DKIM and DMARC — stop attackers spoofing your domain

These three DNS records tell other mail servers that email genuinely came from you (SPF/DKIM) and what to do with messages that fail that check (DMARC), which stops criminals sending convincing fake emails "from" your company. Getting them wrong can block your own legitimate mail, so they're worth setting up carefully or getting IT support to do it.

Coach's tip: start DMARC in "monitor" mode (p=none) so you can see what would be blocked before you switch it to actually reject anything.