Email domain protection, explained for the owner
If a customer, a parent or a supplier receives an email that looks like it came from your organisation, how do they know it really did? Unless your domain publishes a few public records, they cannot. Attackers use this to send invoices, password resets and fee demands in your name. Guardian checks those records, tells you in plain words what is missing and gives your administrator the exact records to add. Checking whether the sender list and policy exist, and watching for lookalike domains, is available now as part of domain protection. Grading of message signing and the exact records to add are being built and are on request.
The problem in one paragraph
Email was designed before anyone thought about forgery. By default, any server on the internet can send a message with your domain in the From line. Three public records, published in your domain's DNS, let receiving mail systems check whether a message really came from you and what to do if it did not. Most organisations have none of them, or have them set so loosely that they change nothing.
What we check
- Sender list (SPF). A public record that names the servers allowed to send email for your domain. Available now: we check that it exists and that it ends with a rule that rejects everyone else. On request: whether it covers the services you actually use.
- Policy (DMARC). A record that tells receivers what to do with a message that fails the checks: let it through, send it to spam or reject it. Available now: we check that a policy exists and whether it is set to monitor only or to quarantine or reject.
- Message signing (DKIM). A signature your mail service adds to each message so a receiver can confirm it was not changed in transit. On request: we check that the signing key is published for each service that sends as you.
- Lookalike domains. Available now: similar names to your domain, such as a swapped letter or a different ending, that are live on the internet, with an alert when a new one appears.
- The rest of your domain. Available now: registrar lock and expiry, DNSSEC, nameservers, certificate authority records, mail server records and newly issued certificates from public logs, with an alert when any of it changes.
What you get
- A plain-language result for each check on your domain, available now.
- The exact records to add or change, ready for your administrator to paste into your DNS provider. On request.
- A recommended order: start by monitoring, then move to a stricter policy once you know every legitimate sender is covered.
- A line in the monthly report, so you can see the domain stay protected after the change.
What we never do
Guardian does not handle, store or read your email. It reads public DNS records, the same ones any receiving mail system reads. Changes are made by your own administrator at your DNS provider.
Status
Domain protection, including the sender list and policy presence checks and lookalike watch, is available now for any domain you own. Message signing grading and the exact records to add are being built and are on request. We do not promise dates.
Questions
Will this stop all fake emails in our name?
No single measure can. Correct records make it much harder for forged messages to reach inboxes, and let receivers reject them. Phishing from lookalike domains is a separate problem that the external attack surface map helps with.
Does Guardian read our email?
No. It reads public DNS records only. Your mail stays with your mail service.
Will adding these records break our email?
It can, if a legitimate sending service is left out of the sender list. That is why the recommended order starts with monitoring and moves to a strict policy only once every sender is covered.
What is available today?
Sender list and policy presence, lookalike domains that are live, registrar lock, expiry, DNSSEC, certificate authority records, mail records and newly issued certificates, with change alerts. Message signing grading and the exact records to add are on request.