If someone spoofed your firm's email address tomorrow — an invoice to a client, a wire instruction to your bookkeeper — would anything stop it from being delivered?
For most small firms, no.
Three DNS records govern whether the world trusts mail claiming to be from your domain. Most businesses have the first two and not the third.
SPF lists which servers may send as you. Nearly everyone has it — it's set up automatically when you configure email.
DKIM cryptographically signs your outbound mail. Also usually automatic.
DMARC is the one that's missing. It tells receiving mail servers what to do when a message fails the first two checks — and without it, the answer is usually "deliver it anyway." It also sends you reports showing who is attempting to send mail using your domain.
The gap matters more than it sounds. SPF and DKIM without DMARC is a lock with no instruction to actually turn it. And unlike most security work, this one is a single DNS record, costs nothing, and touches no software.
What to check this week: ask whoever manages your DNS whether a _dmarc record exists on your domain. If the answer is no, start with a monitoring-only policy — it reports without affecting delivery, so there's no risk of blocking your own mail while you see what's out there.
For firms carrying cyber insurance, this is worth doing before renewal. Email authentication is increasingly on carrier questionnaires, and "we don't know" is a poor answer when premiums are being set.