Clear Path step · Business · Accounts you know and control
Lock your domain and stop others sending email as you
Your domain is locked to the business, and mail pretending to come from your address gets flagged or blocked.
Why it matters: Your domain is your business identity: whoever controls it controls your email and website. Email authentication makes it much harder for criminals to send convincing mail from your address to your clients.
Do it
- Turn on MFA and registrar lock at your domain registrar, and make sure the account belongs to the business, not a former employee or web designer.
- Publish SPF and DKIM records for every service that sends mail as you.
- Publish a DMARC record in monitoring mode, read the reports, then move to quarantine and reject.
- Register obvious lookalike domains if your brand is often impersonated.
Say this: If a message asks me to renew or move our domain, I sign in to the registrar myself instead of using its link.
Check it worked: Your domain registrar account has MFA and registrar lock, SPF, DKIM and DMARC are published for your domain, and DMARC is moving toward quarantine or reject.
If an outside IT company handles your IT, send them this:
Hi, could you please check that our domain registrar account belongs to the business and has MFA and registrar lock on? We'd also like SPF and DKIM published for every service that sends mail as us, and a DMARC record in monitoring mode that we move to quarantine, then reject, after reviewing the reports. Please confirm each step and send us a short summary of the DMARC reports.
Simply put
Your domain is like your business's street address and letterhead. Locking it at the registrar keeps it yours, and email authentication records work like an official seal that tells mail providers which letters really came from you.
In detail
Gmail and Yahoo now require SPF, DKIM and DMARC from bulk senders, so authentication also protects deliverability. DMARC at quarantine or reject stops exact-domain spoofing, not lookalikes, which is why the callback rule still matters.
Points toward the Long View: mail in your name that receiving providers can check is really yours.