SPF / DKIM / DMARC
In one sentence
Email settings that prove your messages are really from you and stop attackers from spoofing your domain.
These three DNS records let receiving mail servers verify that email claiming to be from your domain is legitimate. Together they make it much harder for attackers to send convincing fakes 'from' your company to your customers.
Why it's on your cyber insurance application
Increasingly asked about under email-security questions; publishing them is a low-cost, visible improvement.
What this looks like in practice
These are three DNS records at whoever hosts your domain, and most small businesses either never set them or left DMARC at p=none, which tells receiving servers to do nothing. Start at p=none to see the reports, then move to quarantine once legitimate mail passes. The benefit is practical: it makes it much harder to spoof your domain at your own customers.
How the Readiness Check scores it
The free Check asks the same question a carrier will. Here it is, why it's asked, and the fix if today's honest answer is no. The full application question list has the rest.
Email security
What protections sit in front of your business email?
Why carriers ask: Business email compromise drives more claims than ransomware. Carriers ask what filtering and anti-spoofing protections sit in front of your inbox.
If the answer is no: Move email to Microsoft 365 or Google Workspace if self-hosted; enable their anti-phishing protections and SPF/DKIM/DMARC.
The written evidence carriers accept
A “yes” on the application needs a document behind it. In the Readiness Pack, that document is:
Guides that cover this
Related terms
Would you pass this question today?
The free Readiness Check scores you across the ten control domains carriers probe, in five minutes, no email required for the score.