Email Security for Malaysian SMEs: SPF, DKIM and DMARC Explained

Why email security matters for every Malaysian SME

Email is still the front door to your business. It carries your quotations, invoices, purchase orders and customer conversations. It is also the number one channel criminals use to trick people into sending money or handing over passwords. If someone can send email that looks like it came from your company, they can defraud your customers and suppliers while damaging a reputation you spent years building.

The good news is that a large share of email fraud is preventable with three free records you add to your domain. They are called SPF, DKIM and DMARC. Setting them up is one of the highest value, lowest cost jobs in cybersecurity, and it applies whether you run a trading company in Shah Alam, a clinic in Melaka or a services firm in the Klang Valley.

What email spoofing is and why criminals target your domain

Spoofing means sending an email that appears to come from your address when it did not. By default, the email system was designed in a more trusting era and does not check whether the sender is really who they claim to be. That gap lets an attacker put yourcompany.com.my in the From field of a message they sent from their own server.

Why bother targeting a small business? Because your domain carries trust. A supplier who receives an invoice that looks like it came from you is far more likely to pay a changed bank account. A customer who gets a message from your address is more likely to click a link. Small and mid sized firms are attractive precisely because they often have no protection in place.

Meet the three records: SPF, DKIM and DMARC

Think of these three as a layered check that proves an email is genuine. Each one solves a different part of the problem, and they are strongest when used together.

• SPF (Sender Policy Framework) lists which mail servers are allowed to send email for your domain.
• DKIM (DomainKeys Identified Mail) adds a tamper proof digital signature to every message you send.
• DMARC (Domain based Message Authentication) ties the two together and tells receiving servers what to do with mail that fails the checks.

You do not need to be technical to understand the idea. SPF says who is allowed to speak for you, DKIM proves the message was not altered, and DMARC sets the house rules and sends you reports.

SPF explained in plain English

SPF is a single line you publish in your domain's DNS. It lists the servers and services permitted to send mail on your behalf, for example Microsoft 365, Google Workspace, your accounting system and any marketing tool you use. When a receiving server gets a message claiming to be from you, it checks whether the sending server appears on your SPF list.

The most common SPF mistake is forgetting to include a service you actually use, which causes your genuine mail to fail. The second is having more than one SPF record, which is invalid. A single, complete SPF record that covers every legitimate sender is the goal. If you run email through Microsoft 365, our guide to Microsoft 365 for business explains where these settings live.

DKIM explained in plain English

DKIM adds a cryptographic signature to the hidden header of every email you send. The matching public key sits in your DNS. When your message arrives, the receiving server uses that key to confirm two things: the mail really came from your domain, and nobody changed the content along the way.

This matters because spoofing often involves altering an invoice amount or a bank account number in transit. A valid DKIM signature makes silent tampering detectable. Both Microsoft 365 and Google Workspace can generate DKIM keys for you in a few clicks, and you then publish the record they provide.

DMARC explained in plain English

DMARC is the policy layer that makes SPF and DKIM useful. On its own, an email failing SPF or DKIM might still land in the inbox because the receiving server does not know your wishes. DMARC lets you state a rule: if a message claims to be from us but fails the checks, do nothing, send it to spam, or reject it outright.

DMARC also sends you daily reports showing who is sending email using your domain, including any impersonators. That visibility is gold. It tells you which services you forgot to authorise and whether anyone is actively abusing your name. DMARC is the piece most Malaysian SMEs are missing, and it is where the real protection comes from.

How the three records work together

Picture an email arriving at your customer's mail server. First it checks SPF: was this sent from a server you approved? Then it checks DKIM: is the signature valid and the content unchanged? Finally it applies your DMARC policy: if either check fails and the message claims to be from your domain, follow your instructions.

When all three are aligned, a criminal trying to spoof your domain hits a wall. Their message fails SPF because it came from an unapproved server, fails DKIM because they cannot forge your signature, and gets rejected because your DMARC policy says so. This is layered defence in action, and it is a core part of the cybersecurity baseline we set up for clients.

Business email compromise: the scam these records stop

Business email compromise, or BEC, is the costliest email scam facing Malaysian companies. A typical version goes like this. An attacker studies your business, then emails a customer or your own finance staff pretending to be you or a supplier. The message asks to update bank details or approve an urgent payment. Because it looks legitimate, money moves before anyone questions it.

Strong email authentication attacks this at the root. When your domain enforces DMARC, an outsider cannot convincingly impersonate your real address, which removes the most persuasive version of the scam. Combined with staff awareness, it closes the gap that fraudsters rely on. Our post on phishing examples for Malaysian SMEs shows what these messages look like in practice.

How to check whether your domain is protected today

You do not need special software to run a quick check. Free online tools let you type your domain and see whether you have valid SPF, DKIM and DMARC records. Many Malaysian SMEs discover they have a basic SPF line from years ago, no DKIM, and no DMARC at all, which means their domain is wide open to spoofing.

If you are not sure how to read the results, that is normal. The important thing is to know your current status before you change anything. A short audit tells you which records exist, whether they are valid, and which of your real email services are missing from the list.

Step by step: setting up SPF

Start by listing every service that sends email as your domain. This includes your main mail platform, your accounting or invoicing software, any CRM, your website contact forms and any newsletter tool. Missing one of these is the single biggest cause of legitimate mail failing later.

Next, build one SPF record that includes all of them and publish it in your DNS, replacing any old or duplicate SPF entries. End the record with a soft or hard fail instruction so receiving servers know how to treat unlisted senders. Give DNS a little time to update, then re test. One clean record beats several conflicting ones every time.

Step by step: setting up DKIM

DKIM setup happens in two places. First, in your email platform's admin console, enable DKIM signing for your domain and generate the keys. Microsoft 365 and Google Workspace both provide a simple toggle and give you the record values to publish.

Second, add the DKIM records they provide to your DNS. Once DNS has updated, switch signing on so every outgoing message is signed. Send a test email to an external address and inspect it to confirm the signature is present and valid. If you use additional sending tools such as a marketing platform, enable DKIM for each of them too, because each service signs with its own key.

Step by step: rolling out DMARC safely

DMARC should be introduced gradually so you never block your own mail by accident. The safe path has three stages. Begin in monitor mode, which watches and reports but changes nothing. Read the reports for a couple of weeks to confirm every legitimate sender is passing.

Once the reports look clean, tighten the policy so failing mail goes to spam, then finally to full rejection. This staged approach means you catch any forgotten service in the reporting phase rather than losing real emails.

• Stage 1 monitor: collect reports, block nothing.
• Stage 2 quarantine: send failing mail to spam.
• Stage 3 reject: refuse spoofed mail outright.

Common mistakes that break email authentication

The most frequent problems are simple. Having two SPF records instead of one makes SPF invalid. Forgetting a real sending service means genuine invoices or newsletters start failing. Jumping straight to a strict DMARC reject policy before checking the reports can bounce your own mail.

Another trap is setting everything up once and never revisiting it. When you add a new tool that sends email, such as a booking system or a new marketing platform, you must authorise it too. Treat email authentication as a living configuration, not a one time task. A managed IT support arrangement keeps these records maintained as your tools change.

Email security beyond SPF, DKIM and DMARC

Authentication records stop impersonation of your domain, but a complete email defence has more layers. Attackers can still send convincing messages from lookalike domains or trick staff directly, so people and process matter as much as DNS records.

• Multi factor authentication on every mailbox so a stolen password alone is not enough.
• Staff awareness so people pause before acting on urgent payment requests.
• Advanced filtering to catch malicious links and attachments.
• Reliable backup and recovery so you can restore mailboxes after an incident.
• A verify by phone rule for any change to bank details.

Layered together, these turn email from your weakest point into a controlled one.

Microsoft 365 and Google Workspace: the setup is similar

If you run email on either platform, you already have everything needed to authenticate properly. Both let you enable DKIM signing, both publish clear SPF include values, and both work smoothly with DMARC. The difference is in the admin console layout, not the underlying capability.

Many owners assume that using a big provider means they are automatically protected. They are protected against many threats, but SPF alignment, DKIM signing and a DMARC policy still need to be switched on and configured for your specific domain. If you are weighing the two platforms, our comparison of Google Workspace and Microsoft 365 covers the wider decision.

Email security and PDPA responsibilities

Under Malaysia's Personal Data Protection Act, businesses that handle customer data are expected to keep it reasonably secure. Email is one of the main places that personal data travels, from enquiry forms to invoices and identity documents shared with your team.

An unprotected domain that lets criminals impersonate you and harvest customer information is a weak point in your data protection stance. Setting up SPF, DKIM and DMARC is a practical, documented step that supports your PDPA obligations and shows customers you take the safety of their information seriously.

What it costs and how Cybergate can help

The records themselves are free. The value we add is getting them right the first time and keeping them right as your business grows. That means auditing your current setup, listing every legitimate sender, publishing clean records, and rolling out DMARC in safe stages while watching the reports.

For businesses that would rather not touch DNS, we handle the whole process as part of managed IT and cybersecurity from RM500 per month, or as a one off project. Onsite help across Shah Alam and the Klang Valley starts from RM250 per call out and remote sessions from RM80. We are not SST registered, so the price we quote is the price you pay. It is a small investment for a big reduction in email fraud risk.

How poor email security hurts deliverability and your brand

Spoofing is not the only cost of skipping these records. Receiving servers increasingly use SPF, DKIM and DMARC as trust signals when deciding whether your mail reaches the inbox or the spam folder. A domain with no authentication looks less trustworthy, so even your genuine quotations and invoices are more likely to be filtered out.

There is a brand cost too. When customers repeatedly receive scam messages that appear to come from you, they lose confidence in every email from your address, including the real ones. Getting authentication right protects both your reputation and the simple ability to have your messages land where they should.

Keeping your records healthy as your business grows

Email authentication is not a set and forget job. Every time you add a tool that sends mail on your behalf, a new invoicing system, a booking platform or a fresh marketing service, that sender must be authorised or its messages will start failing. The DMARC reports are your early warning system, showing new senders as they appear.

We recommend a quick review whenever you change email providers or add a new business application, and at least once a year otherwise. This keeps your legitimate mail flowing while your enforcement policy stays strict against impersonators. For growing firms in Shah Alam and the wider Klang Valley, folding this into a managed IT plan means it simply gets handled.

A simple starting checklist for owners

You do not need to become an email expert to move forward. The path is straightforward, and most of it can be handled for you.

• Run a free check to see your current SPF, DKIM and DMARC status.
• List every service that sends email using your domain.
• Publish one clean SPF record covering all of them.
• Enable DKIM signing in your email platform and publish the keys.
• Add DMARC in monitor mode, read the reports, then tighten it.
• Turn on multi factor authentication for every mailbox.

Work through these in order and your domain moves from wide open to well defended in a couple of weeks, without disrupting your day to day mail.

Key takeaways

SPF, DKIM and DMARC are three free DNS records that together prove your email is genuine and stop criminals from spoofing your domain. Every Malaysian business that uses email should have all three configured, not just an old SPF line.

SPF lists your approved senders, DKIM signs your messages so tampering is detectable, and DMARC sets the enforcement rule and sends you reports. Roll DMARC out in stages so you never block your own mail. Pair the records with multi factor authentication, staff awareness and reliable backup for a complete defence. If you want it done for you, our cybersecurity and IT support teams can set it up and maintain it.