Article
Could somebody send an email that looks like it came from your practice?
The From line on an email is just text. Email was designed a long time ago without a built-in way to prove who sent a message, so on its own, nothing stops a stranger from sending mail that shows your practice's domain as the sender. A patient gets a "your balance is past due, pay here" note that looks like it's from you. A vendor gets a "we changed banks" note that looks like it's from your office manager.
What makes that a lot harder is three small records in your domain's DNS: SPF, DKIM and DMARC. You don't need to know how they work. You do need somebody to check that they're there and set right, because once email is set up, nobody tends to look at them again.
What the three records do
- SPF lists the servers and services allowed to send mail for your domain: Microsoft 365 or Google Workspace, your reminder service, your billing company. (Microsoft: Set up SPF)
- DKIM puts a digital signature on each message, with the key to check it published in your DNS. If it checks out, the receiving server knows the message came from a sender you set up and wasn't changed on the way. (Microsoft: Set up DKIM)
- DMARC ties them together. It checks that the domain people actually see in the From line matches what SPF or DKIM verified, and tells receiving servers what to do with mail that fails: nothing special (
p=none), junk folder (p=quarantine), or refuse it (p=reject). It can also ask them to send you daily reports. (Microsoft: Set up DMARC)
What I'd look for first
I don't have numbers on how often small practices get this wrong, so I won't make any up. These are just the spots that are easy to miss:
- No DMARC record at all. SPF is often there because Microsoft 365 setup asks for it. DMARC is a separate step, and it's easy to skip.
- DMARC stuck at
p=none. That's the right place to start, not a place to stay. CISA put it plainly in its email directive to federal agencies:p=none"doesn't actually delay or stop unauthenticated mail from being delivered." Agencies were given a year to get top=reject. (CISA BOD 18-01) - Two SPF records, or one that's too long. A domain gets one SPF record; two causes an error. SPF also fails if checking it takes more than 10 DNS lookups, which gets easier to hit every time a new service adds an "include."
- DKIM never turned on for your own domain. Microsoft's docs say that for custom domains in Microsoft 365, no DKIM signing happens until you set it up. It's two DNS records and a toggle.
- Domains you own but don't use for email. Like the .net you bought so nobody else could. Microsoft says to publish records on those saying no mail should ever come from them.
It's about your own mail getting delivered, too
Since February 2024, Google has required anyone sending to personal Gmail accounts to set up SPF or DKIM, and anyone sending more than 5,000 messages a day to Gmail needs all three. Google says mail that isn't authenticated may be marked as spam or rejected. (Google: Email sender guidelines) If your reminders keep landing in patients' spam folders, this is one of the first places I'd look.
HHS lists email security as an essential goal
HHS's voluntary healthcare Cybersecurity Performance Goals list "Email Security" as an essential goal, meant to "reduce risk from common email-based threats, such as email spoofing, phishing, and fraud." (HHS: Cybersecurity Performance Goals) MFA and staff training are in there too, but these records are the cheap part.
Don't flip it to reject overnight
Go strict before you know everybody who sends as you, and your own billing statements start bouncing.
Microsoft lays out a slow path: start DMARC at p=none with reports turned on, use the reports to find every legitimate service sending as you, fix SPF and DKIM for those, then move to quarantine, then reject. The reports are XML files and no fun to read, so most folks use a reporting service.
For a quick look yourself, open PowerShell on a Windows PC and run Resolve-DnsName _dmarc.yourdomain.com -Type TXT, with your real domain in place of yourdomain.com. If nothing comes back, you don't have a DMARC record.
Want a second set of eyes?
I'm Kevin Roper, and I run Roper IT Consulting out of Holly Springs, NC. I've been in IT for more than 25 years, most of it in healthcare. I do a fixed-price $750 healthcare IT security assessment for small practices and clinics. I'll check your email setup, including SPF, DKIM and DMARC, along with backups, accounts and the other common gaps, then give you a plain-English list of what to fix first. If you'd rather start smaller, there's a $250 quick check, and what you pay for it comes off the $750 assessment if you go ahead. I work remotely with practices anywhere, and on-site around Raleigh and Wake County.
If you'd like to set one up, request a consultation at roperitconsulting.com.