Security & Safety Resource Center

The financial stakes are enormous. The FBI’s 2025 Internet Crime Report recorded $3 billion in reported business email compromise losses. SPF, DKIM and DMARC will not stop every compromised inbox or lookalike domain, but they make direct spoofing of your domain easier to detect and reject.

What is SPF and how does it protect business email?

Sender Policy Framework, or SPF, is a DNS record listing the systems authorized to send email for your domain. When a receiving server gets a message, it checks whether the sending server is permitted by that record. This helps detect mail sent from an unauthorized server claiming to use your domain.

What is DKIM and how is it different from SPF?

DomainKeys Identified Mail, or DKIM, adds a cryptographic signature to outgoing messages. Your mail service signs the message with a private key; receiving systems use the public key in your DNS to verify the signature and confirm that signed content was not altered in transit.

SPF focuses on the sending infrastructure. DKIM focuses on a domain-backed signature that can survive some forwarding scenarios. Google’s DKIM setup guidance explains the public and private key pair and recommends 2048-bit keys when the domain provider supports them.

Do you need SPF, DKIM and DMARC?

Yes. CISA says the three methods are not intended to work in isolation. Its email-authentication guidance recommends implementing SPF, DKIM and DMARC together. DMARC checks whether authenticated domains align with the visible From address and tells receiving systems what to do with messages that fail—monitor, quarantine or reject. It also provides reports that reveal legitimate senders you missed and attempts to impersonate your domain.

How should a small business set up email authentication?

1. Inventory every sender. List your primary mail platform and every vendor that sends using your domain. Include marketing, CRM, ticketing, accounting and website systems.
2. Publish one complete SPF record. Follow each provider’s instructions and authorize only current senders. Remove services you no longer use.
3. Enable DKIM signing. Generate the key through your email provider, publish the public key in DNS and switch signing on. Protect private keys and rotate them according to provider guidance.
4. Add DMARC in monitoring mode. Start with a reporting policy so you can collect data without blocking legitimate mail. Use a dedicated mailbox or reporting service to review aggregate reports.
5. Fix alignment problems. Confirm that newsletters, invoices and other third-party systems pass SPF or DKIM with a domain aligned to the visible From address.
6. Increase enforcement gradually. Move from monitoring to quarantine and then reject after reports show that authorized mail passes consistently.
7. Test and document. Send messages to major providers, inspect authentication results and record owners, vendors and renewal procedures.

What mistakes can break SPF or DKIM?

• Forgetting third-party senders: A billing or marketing platform may send legitimate mail that fails authentication.
• Publishing conflicting records: Multiple SPF records can cause errors; combine authorized senders correctly.
• Changing messages after signing: Gateways that add footers or rewrite content can invalidate DKIM.
• Skipping unused domains: Even a domain that sends no mail should have defensive SPF and DMARC policies to discourage spoofing.
• Enforcing too quickly: A reject policy before inventory and monitoring can block real customer communications.
• Ignoring reports: DMARC data only helps when someone reviews failures and unknown senders.

What threats do SPF and DKIM not stop?

Authentication does not prove that the message itself is honest. A criminal can compromise a legitimate employee mailbox, register a lookalike domain or abuse an authorized marketing account. Keep MFA on every mailbox, limit administrator privileges, train staff to verify payment and banking changes through a second channel, and monitor forwarding rules and unfamiliar logins.

Make email authentication part of business maintenance

Correctly configured SPF, DKIM and DMARC reduce domain spoofing and show who is sending mail in your name. Review the records quarterly and whenever a vendor changes. Start today by asking your email provider to confirm the authentication status of every business domain.

The stakes are real. The FBI’s 2025 Internet Crime Complaint Center summary recorded $1.3 billion in reported personal data breach losses. Reducing unnecessary accounts and devices cannot prevent every breach, but it limits the number of services holding your information and the number of entry points an attacker can try.

Why do unused accounts increase online risk?

An abandoned account may still contain your name, address, payment history, private messages or a reused password. Because you rarely sign in, you may miss a breach notice, password-reset message or unfamiliar login. A criminal who takes over the account might use stored data to impersonate you, target other services or send scams to people who trust you.

Which accounts should you delete or keep?

• Delete accounts you no longer use: Old retailers, forums, trials, games and apps do not need permanent access to your information.
• Close duplicates: Keep one active profile when several accounts serve the same purpose.
• Review accounts with stored payment data: Remove cards and addresses even if you are not ready to close the account.
• Keep accounts tied to records: Preserve access when you need warranties, tax documents, medical information or purchase history.
• Protect recovery accounts: Your primary email, mobile account and password manager need the strongest security because they unlock other services.

Does deleting an app delete the account?

Usually not. Removing an app from a phone may leave the online account, cloud data, subscriptions and connected permissions intact. Sign in through the official service, download anything you need, cancel paid plans and use its account-deletion control. Save confirmation before removing the app.

How do you audit your digital accounts?

1. Build an account list. Check your password manager, saved browser logins, email for “welcome” and “verify” messages, app stores and bank statements for subscriptions.
2. Prioritize high-value services. Start with email, banking, cloud storage, healthcare, social media and accounts with saved payment methods.
3. Secure what you keep. Give every account a unique password, enable multifactor authentication and update recovery information.
4. Disconnect third parties. Review “Sign in with” connections, linked apps and active sessions. Remove anything unfamiliar or unnecessary.
5. Delete carefully. Export needed records, remove stored cards and personal data, then use the official deletion process rather than simply abandoning the login.
6. Track the result. Record deletion requests and recheck later. Some services take time to complete them.

Which devices should you disconnect or retire?

• Remove old devices from Apple, Google, Microsoft and other account dashboards.
• Sign out of streaming, email, cloud and shopping services before disposal.
• Transfer authenticator apps and recovery codes before wiping a phone.
• Back up necessary files and verify that the backup opens.
• Factory-reset the device using the manufacturer’s official instructions.
• Remove SIM and memory cards, then recycle electronics responsibly.

The FTC advises users to unlink accounts, remove storage cards and erase personal information before trading in or disposing of a phone. Deleting files one by one is not a substitute for the approved reset process.

Can fewer accounts replace strong cybersecurity?

No. One poorly protected email account can still expose your entire digital life. Digital decluttering works best with unique passwords, MFA, automatic updates, backups and careful link handling. Think of it as reducing the number of doors; you still need strong locks on the doors that remain.

Start with a 15-minute digital cleanup

Reducing digital clutter makes you safer online because fewer services store your data, fewer devices need patches and fewer alerts compete for your attention. Start small: delete one unused account, remove one old device from your account dashboard and turn on MFA for the email address that controls your resets. Repeat monthly until every account and device has a clear purpose and owner.

The financial risk is serious, too. The FBI’s 2025 Internet Crime Complaint Center summary recorded $929 million in reported confidence and romance scam losses. Safer profiles cannot stop every dishonest match, but limiting public details makes targeting, password guessing and convincing impersonation harder.

What information should you leave off a dating profile?

• Your home location: Use a general city or neighborhood, not an address, apartment view, street sign or nearby landmark.
• Your exact workplace: A broad profession is safer than naming the employer, office, department or schedule.
• Your daily routine: Avoid posting regular gym times, commute routes, favorite quiet spots or dates when you will be away.
• Security-question material: Leave out full birthdays, pet names, childhood schools, hometown details and family names.
• Contact and financial details: Never publish your personal email, phone number, banking information or government ID.
• Photos that reveal too much: Check backgrounds for house numbers, work badges, license plates, school logos and children’s information.

Can dating profile details help someone guess a password?

Yes. Password guesses often use names, dates, teams, pets and places. Even if the password itself is stronger, the same details may help someone answer weak recovery questions. Use a password manager to create a unique password for the dating account, enable multifactor authentication and choose random answers for security questions when the service allows it.

How can you tell whether an online match is catfishing you?

Go slowly and look for consistency rather than relying on chemistry alone. The FBI advises people to research profile photos and details, question fast-moving relationships and treat repeated excuses to avoid meeting as suspicious.

1. Keep early conversations on the platform. Dating services may provide reporting tools and safety controls that disappear when you move immediately to private text or encrypted chat.
2. Reverse-search profile photos. Look for the same image under another name, job or location. Also search distinctive phrases from the profile.
3. Ask ordinary follow-up questions. Scammers reuse scripts. Details that continually change—or answers that never address your question—deserve attention.
4. Use live video before meeting. A short call can expose stolen photos, although deepfakes and prerecorded video mean it is not absolute proof.
5. Tell someone you trust. An outside perspective can notice pressure, contradictions and isolation tactics that excitement makes easy to miss.
6. Never send money or financial access. Emergencies, travel costs, investment opportunities and requests to receive or move funds are reasons to end contact.

How can you meet an online date more safely?

• Do not let the other person pick you up at home.
• Protect your drink and stay clear-headed enough to make decisions.
• Leave immediately if the person pressures, threatens or isolates you.
• Use the app’s block and report tools after unsafe behavior.
• Call emergency services if you believe you are in immediate danger.

The FTC’s romance-scam guidance recommends never sending money or gifts to a love interest you have not met in person and suggests reverse image searches when a profile seems suspicious.

What should you do if a match misuses your information?

Stop contact and preserve the profile, messages, payment records and usernames before blocking the account. Change any exposed or reused password, secure your email first and review account recovery details and active sessions. If you shared financial information or sent money, contact the bank or payment provider immediately and ask about recovery options.

Make privacy part of your dating routine

A lower-detail profile gives strangers fewer clues to locate you, guess passwords or manufacture instant compatibility. Independent verification helps you catch copied identities before trust becomes financial or physical access. Review your profile today: remove one identifying detail, enable MFA and check every photo background. A safer profile can still be warm, specific and memorable without publishing the map to your offline life.

Phishing remains widespread. CISA notes that the FBI received 193,407 phishing complaints in 2024, making it the most reported cybercrime that year. Treat every unexpected reward as unverified, even when the message appears to come from a company you know.

How does a fake gift card offer work?

The prize is bait. The real goal may be your account credentials, card number, address or device access. A scammer may also ask you to buy another gift card to cover fees and send the card number and PIN. The FTC is clear: no honest business or government agency will require gift-card payment to release a prize.

What are the signs of a gift card phishing scam?

• You never entered the contest: A prize for an event you do not remember joining is not a lucky break.
• The message creates urgency: “Claim now,” countdown timers and threats of expiration discourage verification.
• The sender does not match the brand: Look for extra characters, free email accounts or a strange reply-to address.
• The link is misspelled or shortened: A familiar brand name inside a longer, unrelated address can hide the destination.
• The offer asks for sensitive information: A legitimate gift should not require your password, one-time code or full payment details.
• You must pay to receive the prize: Fees by gift card, wire transfer, cryptocurrency or payment app signal a scam.

What should you do when a suspicious gift card offer arrives?

1. Do not click or reply. Avoid buttons, links, attachments, QR codes and “unsubscribe” options inside the message.
2. Inspect without interacting. Check the sender and preview the destination on a computer by hovering over the link. Misspellings help, but polished wording does not prove safety.
3. Verify independently. Open the company’s official app or type its known address yourself. Check your rewards or promotions there, or contact support using information you found independently.
4. Delete and report the message. Mark it as phishing or junk so your provider can improve filtering. If it reached a work account, follow your organization’s reporting process.
5. Warn others carefully. Share a screenshot or description, not the active link. A quick warning may stop the same lure from reaching family or coworkers.

CISA describes phishing as messages or malicious websites that impersonate trusted entities to steal information or deliver malware. Its phishing guidance recommends skepticism toward urgent, too-good-to-be-true offers and suspicious hyperlinks.

Can clicking a gift card link install malware?

It can, although many phishing pages focus on stealing what you type. Close the page if you clicked but did not enter anything. Do not approve downloads, browser notifications, profiles or security prompts. Update the device and browser, then run a scan with trusted security software already installed on the device.

If you entered a password, change it immediately through the real service and anywhere you reused it. Enable multifactor authentication, review active sessions and protect your primary email first because it can reset other accounts. If you entered payment details, contact the issuer through the number on the card.

What if you bought or shared a gift card?

Contact the gift card company immediately and ask whether it can freeze the funds or issue a refund. Keep the physical card, purchase receipt, packaging and every message. Do not trust anyone who later promises to recover the money for an upfront fee; recovery scams often target people twice.

Turn “pause and verify” into a habit

Ignoring an unsolicited gift card offer protects more than the promised reward. It keeps your credentials out of copycat login pages, prevents small “fees” from exposing a card and blocks attackers from using a compromised account against people who trust you. The safest response is simple: leave the message, reach the company independently and delete the lure.