Recommendations

1. 1Upgrade your DMARC policy from p=quarantine to p=reject for full blocking▾

   With p=quarantine, spoofed emails are sent to spam instead of being blocked outright. Some recipients still check spam folders, and sophisticated attacks can be flagged as legitimate by users. p=reject ensures fraudulent emails never reach any folder.

2. 2Add an SPF record: yourdomain TXT "v=spf1 include:yourprovider -all"▾

   SPF tells receiving servers which IP addresses are allowed to send email for your domain. Without it, any server in the world can send emails appearing to come from you. Adding SPF with -all (hardfail) means unauthorized senders will be rejected.

3. 3Add MTA-STS to enforce TLS encryption for incoming emails▾

   Without MTA-STS, an attacker performing a man-in-the-middle attack can downgrade the connection between mail servers to plaintext, intercepting emails in transit. MTA-STS tells sending servers to only deliver via TLS with a valid certificate, preventing downgrade attacks.