Here's an uncomfortable fact about how email works. By default, nothing stops a stranger from sending a message that says it came from your practice's address. The protocol was designed in an era when everyone on the network was assumed to be trustworthy, and the trust never got added at the bottom — it got bolted on top, optionally, decades later.

The bolt-on is three records you publish in your domain's DNS: SPF, DKIM, and DMARC. Together they let receiving mail servers check whether a message claiming to be from you was actually authorized by you, and tell them what to do when the answer is no. That last part is where small practices get caught.

The setting that does nothing

When I scan a small healthcare domain, the most common result isn't a missing DMARC record. It's a DMARC record set to p=none.

p=none means: check the message, and if it's forged, deliver it anyway. Just send me a report about it.

That's the correct starting position. You publish p=none for a few weeks, read the reports, find the legitimate senders you forgot about — the billing service, the appointment reminder system, the newsletter tool, the practice management software — and authorize them. Then you tighten to p=quarantine, and eventually p=reject, where forged mail actually gets stopped.

Almost nobody does the second part. The record gets published during some IT project, the reports go to an address nobody reads, and it sits at p=none for years. The practice has the paperwork of protection with none of the effect.

What forged mail actually costs a small practice

The scenario isn't dramatic. It's an invoice.

Someone sends your bookkeeper an email that appears to come from your office manager, asking them to update the bank details for a vendor payment. Or a message to a patient that looks like your practice, asking them to confirm their insurance information on a page that isn't yours. Or a note to a referring physician's office that damages a relationship you spent years building.

Your domain's reputation is an asset you've never had to think about, because it's been working. The practices that get hit find out how much it was worth on the day it stops.

What to do about it

This one isn't a fifteen-minute fix, and I'm not going to pretend it is. Getting to p=reject safely takes a few weeks of watching reports, because tightening too early means your own legitimate mail starts disappearing — and the mail that disappears is usually appointment reminders.

Check what you have today. Free lookup tools will show your SPF, DKIM, and DMARC records. Look at the p= value on the DMARC record. If it says none, you're monitoring, not protecting.

Point the reports somewhere a human reads. The rua= address in the record is where aggregate reports go. If it's an old employee's mailbox, the last several years of evidence went into a void.

Inventory who sends mail as you. Practice management software, billing service, appointment reminders, marketing tool, e-fax, your own mail server. Each one needs to be authorized, and each one is a chance to break something if you miss it.

Move to p=quarantine, then p=reject. In stages, watching the reports between each step.

Turn on multi-factor authentication while you're in there. Spoofing is someone pretending to be you from outside. A compromised mailbox is someone actually being you from inside, and it's worse. MFA is the single highest-value thing most small practices haven't finished rolling out.

That last one matters more than the rest of the list. If I could only get a practice to do one thing, it would be that.

Why this sits unfinished so often

Because it's invisible when it works and invisible when it doesn't, right up until the day it isn't. There's no alert. No dashboard turns red. The reports arrive in a format built for mail administrators, not for a practice manager with eleven other things to do.

This is what I mean when I say most IT problems at small practices aren't technical problems. Somebody knew, at some point, that this needed finishing. Then the project ended, the consultant moved on, and nobody owned the last three steps.