DNS, Explained: Caller ID for Your Company’s Email

Picture a customer opening an email that appears to come from your business. It has your name, your logo, and your email address, and it politely mentions that your banking details have changed, so could they please send this month’s payment to the new account. You never wrote it, and you would have no idea it existed until someone called to ask why their payment never arrived.

That scenario is a form of business email compromise, and it is expensive. The FBI’s 2025 Internet Crime Report counted more than $3 billion in reported losses from business email compromise across nearly 25,000 complaints, making it the second-costliest category of internet crime that year. Not every one of those cases involved a faked “From” address, but pretending to be someone trustworthy is the common thread.

The good news is that there is a set of tools built specifically to stop someone from sending email as you. SPF (S – P – F) , DKIM (Dee-Kim), and DMARC (Dee-Marc), are doing all the heavy lifting and they all live in something called DNS, so that’s where we’ll start.

DNS, the phone book of the Internet

Every device on the internet has a numeric address, called an IP address, which is how computers find each other. Computers are perfectly happy with numbers, but people are not, which is why nobody prints something like 203.0.113.42 on their business card.

DNS, short for the Domain Name System, is the internet’s phone book. When you type a website name into your browser, your computer looks up that name in DNS and gets back the number it needs to connect. It all happens in a fraction of a second, which is why most people never notice it’s there.

Like an old-fashioned phone book, a DNS listing can hold more than one entry for the same name. Your domain’s listing can say where your website lives and where email addressed to you should be delivered, and, importantly for this conversation, it can hold public notes that anyone can read. Those notes are where the security story begins.

Your email has caller ID too (and it can be faked)

If you’ve ever answered a call from a local-looking number only to hear a robocall on the other end, you’ve met caller ID spoofing. Caller ID was designed long before anyone expected people to abuse it, so for years the phone network simply took the number a caller sent at face value.

Email has the same weakness. The “From” address on a message works a lot like caller ID, since it shows whatever the sender put there, and on its own nothing stops someone from putting your address in it.

The phone industry’s fix was a caller ID authentication system called STIR/SHAKEN, which the FCC required phone companies to implement by June 30, 2021 so they could verify that the caller ID on a call matches the number it actually came from. Email’s fix is three records that live in your DNS listing, which is convenient, because DNS is already a phone book.

How Email ‘checks the caller’ before picking up

Alongside your address, your domain’s DNS listing holds those three public notes, and together they tell the rest of the internet how to check whether an email really came from you. When your message arrives, the recipient’s mail server looks up your listing, runs the checks, and then decides where the message should go.

SPF: your list of approved phone lines

SPF (Sender Policy Framework) is the list of servers and services allowed to send email as your business. A company might have a main line, a support line, and a sales line, and in the same way your email might come from your main email provider, a newsletter tool, the accounting software that emails invoices, or the helpdesk system that sends ticket updates.

If a message claiming to be from you comes from a service that isn’t on the list, that’s like a call showing your company name while coming from a line you’ve never owned. The catch is that the list has to be complete, because if someone signs up for a new service that sends email as your company and nobody adds it to SPF, your own legitimate emails can start looking suspicious.

DKIM: the verified caller check

DKIM (DomainKeys Identified Mail) adds a digital signature to every message your approved services send, and the key needed to check that signature is published in your DNS listing so any receiving server can verify it.

It does for email roughly what STIR/SHAKEN does for phone calls, providing proof that the message genuinely came from you. It also shows whether anyone altered the message along the way, since a changed message no longer matches its signature.

DMARC: your instructions to the phone company

SPF and DKIM provide the evidence, while DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do with a message that claims to be from you but fails the checks. The three options will sound familiar to anyone who has set up call handling:

• None: let it ring through, but make a note of it.
• Quarantine: send it to voicemail, which in email terms means the spam or junk folder.
• Reject: block it so it never gets through.

DMARC also lets you ask receiving servers to send you reports, which work a bit like a call log of everyone who has been using your number. Those reports show which services are sending as your domain, which helps you spot both forgotten legitimate tools and impostors who have no business using your name.

Why ‘set up properly’ is the important part

Having these records is not the same as having them working. A DMARC policy of “none” is a sensible place to start, because it lets you collect reports and confirm your list of approved lines is complete before you start blocking anything. The trouble comes when a domain stays there for good, which is a bit like keeping a detailed log of every robocall pretending to be your business and never actually blocking one.

The goal is to work toward quarantine or reject once you’re confident your legitimate email is passing, and to keep the approved list current as your business adds or retires tools. It’s less a one-time task and more like a company phone directory that needs an occasional update.

The big mail providers are screening calls now

There’s also a practical reason this matters beyond security. Since February 2024, Google and Yahoo have required bulk senders (Google defines these as senders of roughly 5,000 or more messages a day to Gmail accounts) to use SPF, DKIM, and DMARC. Microsoft followed with similar requirements starting in May 2025.

Even if you don’t come close to sending that much email, your business isn’t entirely off the hook – Google’s guidelines require every sender to use at least SPF or DKIM. In other words, the biggest email providers in the world now require these records, and email that can’t prove who it’s from is more likely to end up in spam, or not get through at all.

Nothing is foolproof – what DMARC, DKIM, & SPF can’t catch

It’s worth being clear about the limits. These records protect your exact domain, so they can stop someone from sending as yourbusiness.com. They can’t stop someone from registering a lookalike such as yourbuisness.com, which is the email version of a scammer calling from a number one digit off from yours. They also can’t help if a real mailbox has been taken over, since email from a compromised account is coming from your genuine line and passes every check.

That’s why email authentication is one layer of a broader security posture rather than the whole thing. It works best alongside protections like multi-factor authentication on email accounts, a little training so people know what suspicious messages look like, and a simple habit of confirming any change to payment details with a phone call to a number you already have on file.

Quick check-up for your business email

You don’t need to become a DNS expert to know where you stand. Whoever manages your domain and email, whether that’s an internal IT person or an outside partner, should be able to answer these quickly:

• Do we have SPF, DKIM, and DMARC records published for our domain?
• What is our current DMARC policy, and is there a plan to move it toward quarantine or reject?
• Is anyone reviewing the DMARC reports?
• Does our SPF record include every service that sends email as us?