This is a sample report for a made-up law firm, so you can see exactly what you get. It was produced by the same system that writes every real report.

ProNet Cyber

Email impersonation report for oakfieldlaw.co.uk

Can someone send email pretending to be you – and how to stop it

4 November 2026 · High risk

When you make the changes, copy each DNS record from the online version of this report (the link in your email), not from this PDF. Copying from a PDF can add line breaks or change characters, which breaks a record.

No DMARC record: anyone can send email as this domain.

This report sets out, in plain English:

Hand the “How to fix it” section to a competent person, such as your email provider, IT support or web developer — they will know what to do with it.

Stuck? See Help and questions

1. What we found

DMARC: Not published — there is no protection. Problem

SPF: Published, and ends in ~all (soft). It uses 1 of the 10 DNS lookups SPF allows. Good

DKIM: No signing key found on the common selectors. Check DKIM signing is switched on with your email provider. Needs work

MTA-STS: Not set up. TLS reporting (_smtp._tls) is not set up. This is optional: it makes sure email sent to you travels encrypted, and has no effect on impersonation. Optional

Good: nothing to do. Needs work: worth fixing. Problem: fix this first. Optional: an extra, not needed to stop impersonation.

Your domain’s current records, for reference:

DMARC (_dmarc.oakfieldlaw.co.uk): (none)

SPF (oakfieldlaw.co.uk): v=spf1 include:_spf.google.com ~all

2. Why it matters

3. How to fix it

Before you change anything: save this report (use Save as PDF at the top). It records your settings exactly as they are today, so you can always put them back.

These changes are made in your domain’s DNS settings, with your domain registrar or email provider. Do them in order — the staged rollout is deliberate, so you never block your own genuine email.

  1. SPF is fine for now. Your SPF record already lists your email provider. Leave it as it is.
  2. Switch on DKIM before you tighten anything. DKIM signs your genuine email so it still passes when it is forwarded or sent through another service. In the Google Workspace admin console, go to Apps → Google Workspace → Gmail → Authenticate email, generate a key, add the google._domainkey TXT record it shows, then press “Start authentication”. We look for DKIM on the most common names; if your provider says it is already on, it may simply use a name we did not check.
  3. Start DMARC in “monitor” mode. Add a TXT record at _dmarc.oakfieldlaw.co.uk. It blocks nothing — it only reports who sends email as you:v=DMARC1; p=none; rua=mailto:[email protected]; fo=1Reports go to the address in the record, so create that mailbox (or use an address you check). Leave this in place for 2–4 weeks.
  4. Then tighten to “quarantine”. Change the record to:v=DMARC1; p=quarantine; rua=mailto:[email protected]; fo=1Forged mail now goes to spam. Only take this step once DKIM is on and the reports show every service that sends email for you passing. The reports arrive as data files rather than readable emails — your IT person, or our monitoring service, can check them for you.
  5. Finally, tighten to “reject”. After another 2–4 weeks with no genuine email going to spam, change the record to:v=DMARC1; p=reject; rua=mailto:[email protected]; fo=1Forged mail is now blocked outright. You are protected. Only take this step once DKIM is on and the reports show every service that sends email for you passing. The reports arrive as data files rather than readable emails — your IT person, or our monitoring service, can check them for you.

If genuine email ever stops arriving after a change, put the DMARC record back to v=DMARC1; p=none; rua=mailto:[email protected] straight away. Nothing is blocked while the policy is p=none, and the change usually takes effect within a few hours.

We provide the exact settings; we do not log in to or change your systems. Your email provider or IT person can apply these in minutes.

4. What happens next

Keep watch on oakfieldlaw.co.uk – £9 a month

5. Help and questions

What is DNS?

DNS is the public list of settings that tells the internet where your website and email live. The records in this report are added to that list. Changing them does not touch your website, your mailboxes or your computers.

Where do I make these changes?

They are made wherever the DNS for oakfieldlaw.co.uk is managed — usually the company you bought the domain from. Look for “DNS settings” and the option to add a TXT record.

Will this break my email?

Not if you take the steps in order. The early steps only add information and switch on reports; nothing is blocked. The steps that block forged mail wait until the reports show all your genuine email passing, and if anything ever goes wrong, the undo line in the report puts it straight back.

How long does it take?

Each change takes a few minutes to make and usually works within a few hours. The whole plan takes a few weeks, because of the waiting periods while the reports come in.

We also send email through other services (a newsletter, invoicing, a booking system). What do we do?

Each service that sends email as you needs to be covered by SPF or to sign its mail with DKIM. Its own help pages give the line to add. The DMARC reports then show you every service sending as you, so nothing is missed.

What are the DMARC reports?

Once a day the big email providers send a short data file to the report address, listing who sent email as you and whether it passed. They are meant for software rather than people, so your IT person, or our monitoring service, can read them for you.

How do I know I have done it right?

Use the Check my changes button at the top of this report. It looks at your settings again and tells you what is right and what to do next.

Official guides