Latest / Modularity Podcast / Why Your Invoices Vanish: SPF, DKIM, and DMARC Fixes

Transcript

Why Your Invoices Vanish: SPF, DKIM, and DMARC Fixes · Modularity Podcast

• 0:00
  So, I- I- I was talking to this contractor last week.
• 0:03
  Local guy, does great work, but he was literally tearing his hair out because he
• 0:10
  had about twelve grand in outstanding invoices just sitting there.
• 0:15
  And when he finally called the clients, every single one of them said the exact same
• 0:21
  thing: "Oh, I- I never got the invoice."
• 0:25
  Let me guess.
• 0:26
  They weren't actually dodging him.
• 0:28
  The emails just straight up vanished into the digital ether.
• 0:31
  Exactly!
• 0:31
  They weren't even in the spam folder.
• 0:33
  They were just, like, blocked at the gateway.
• 0:35
  And look, it's not like there was a single, sudden vendor switch flipped overnight.
• 0:40
  Major providers like Google and Yahoo have been progressively tightening email
• 0:45
  authentication and filtering for years.
• 0:48
  But between recent enforcement windows and a mix of factors-like your
• 0:52
  authentication, sending reputation, content, and volume patterns-your deliverability
• 0:57
  can quietly plummet.
• 0:59
  Suddenly, automated emails from QuickBooks or Jobber just get vaporized.
• 1:04
  It's a massive, silent cash flow killer.
• 1:08
  It's wild because business owners think, "Well, I- I pay for QuickBooks,
• 1:12
  so obviously QuickBooks knows how to send an email."
• 1:15
  But from the perspective of Google or Yahoo, when QuickBooks sends an invoice
• 1:21
  showing your email address, say, jim@jimsplumbing.com, but it originates from an
• 1:26
  Intuit server...
• 1:28
  that looks exactly like a phishing scam.
• 1:31
  It's like someone trying to cash a check with your name on it but using a photocopy
• 1:36
  of your ID.
• 1:37
  Right!
• 1:37
  It's- it's identity theft in the eyes of the spam filter.
• 1:40
  And the mail servers don't take risks anymore.
• 1:43
  They just drop the message.
• 1:44
  No bounce-back, no warning.
• 1:46
  Just...
• 1:47
  gone.
• 1:47
  We should probably explain how the mail servers actually verify this,
• 1:51
  because it sounds like alphabet soup to most people-you know,
• 1:54
  SPF, DKIM, DMARC.
• 1:56
  But it's actually pretty simple if you think of it like physical mail security.
• 2:00
  SPF, or Sender Policy Framework, is basically just an authorized guest list for your
• 2:06
  domain.
• 2:07
  It's a text record on your domain name that says, "Hey, I allow QuickBooks,
• 2:12
  Calendly, and Housecall Pro to send mail using my name."
• 2:15
  If a server gets an email from QuickBooks claiming to be you,
• 2:19
  it checks the list.
• 2:21
  If QuickBooks isn't on it, boom-denied.
• 2:24
  Okay, that makes sense.
• 2:25
  So SPF is the guest list.
• 2:27
  But what about DKIM?
• 2:29
  That's the...
• 2:30
  the cryptographic signature thing, right?
• 2:32
  Exactly.
• 2:32
  Think of DKIM as a holographic wax seal on the envelope.
• 2:36
  It's a digital signature that proves the email wasn't tampered with mid-transit.
• 2:40
  The receiving server uses a public key-which, again, lives in your domain's DNS
• 2:45
  settings-to verify that the seal is authentic.
• 2:48
  If the seal is broken, or if there is no seal at all, the server gets suspicious.
• 2:53
  So we've got the guest list and the holographic wax seal.
• 2:56
  Where does DMARC fit in?
• 2:58
  Because that's the one that usually throws people off.
• 3:00
  DMARC is the security bouncer standing at the door.
• 3:03
  It looks at the guest list-the SPF-and the wax seal-the DKIM-and it tells the
• 3:10
  receiving server exactly what to do if those two things don't match up.
• 3:14
  You can tell the bouncer to just monitor things, or you can tell them to actively
• 3:19
  reject any message that fails verification and throw it straight into the garbage.
• 3:24
  And the problem is, if you're running a service business, you aren't just sending
• 3:29
  emails from your Outlook or Gmail inbox.
• 3:32
  You've got Jobber sending dispatch notifications, Calendly sending booking
• 3:38
  confirmations, Stripe sending receipts, maybe HubSpot sending newsletters.
• 3:43
  If even one of those tools is unauthenticated, your booking no-show rates skyrocket
• 3:49
  because people literally don't know they have an appointment.
• 3:52
  And then you're sitting there wondering why your schedule is empty and your bills
• 3:56
  aren't paid.
• 3:57
  It's a nightmare, but the good news is it is entirely fixable.
• 4:00
  It doesn't take weeks.
• 4:02
  You just need to be methodical.
• 4:03
  The first step is literally just writing down every single tool you use that sends
• 4:08
  mail.
• 4:09
  Don't guess.
• 4:10
  Go through your bank statements if you have to.
• 4:12
  QuickBooks, Housecall Pro, Mailchimp, active campaign-get them all on one list.
• 4:18
  Right, because if you miss one, that's the one that's going to keep failing.
• 4:21
  And once you have that list, you have to actually log into your domain registrar,
• 4:27
  or where your DNS points to-you know, GoDaddy, Namecheap, Cloudflare,
• 4:31
  us at ModularityHosting.com, wherever you bought your domain name-and update those
• 4:36
  DNS records.
• 4:37
  Yes.
• 4:38
  Every one of those tools will have a settings page, usually under "Domain
• 4:42
  Verification" or "Email Settings," that gives you the exact TXT records you need to
• 4:48
  copy and paste.
• 4:49
  You're basically adding their specific mail servers to your SPF guest list and
• 4:55
  generating that DKIM key for them to sign their emails.
• 4:58
  So, what are some quick wins people can actually do, like, this week to make sure
• 5:03
  they aren't leaking cash?
• 5:04
  First, do a real-world test.
• 5:06
  Send an invoice or a booking confirmation directly from your software to a personal
• 5:11
  Gmail or Yahoo account.
• 5:13
  Don't use your work email, because your work server already trusts you.
• 5:17
  Use a completely external, free account.
• 5:20
  Did it go to the inbox?
• 5:21
  Did it land in spam?
• 5:23
  Or did it not show up at all?
• 5:24
  That's your baseline.
• 5:26
  And what if it does land in spam, or doesn't show up?
• 5:30
  Is there an easy way to see *why* it failed without digging through raw email
• 5:35
  headers?
• 5:35
  Oh, absolutely.
• 5:36
  There are free tools like MXToolbox or mail-tester.com.
• 5:42
  You just send a test email to a unique address they provide,
• 5:45
  and it gives you a simple, color-coded report card.
• 5:48
  Red, yellow, green.
• 5:50
  It'll tell you exactly if your SPF is missing, or if your DKIM signature is invalid.
• 5:56
  That's huge.
• 5:57
  And, you know, another quick win-especially if you're on Google Workspace or
• 6:02
  Microsoft 365-is to check if your software allows for a direct OAuth connection.
• 6:07
  Some billing and booking platforms let you log directly into your Microsoft or
• 6:11
  Google account through their settings.
• 6:13
  When you do that, the software actually sends the email *through* your real inbox
• 6:18
  server, rather than on behalf of it.
• 6:21
  It completely bypasses the whole third-party authentication headache because it's
• 6:26
  genuinely coming from your official account.
• 6:29
  Yes!
• 6:29
  If that option is available, use it.
• 6:32
  It's a total cheat code for small business owners who don't want to mess around with
• 6:36
  DNS records.
• 6:37
  Look, your domain reputation is a physical asset.
• 6:40
  If your domain gets blacklisted because of bad security settings,
• 6:44
  it can take months to repair that trust with Google and Yahoo.
• 6:47
  It's just not worth the risk when the fix is right there.
• 6:50
  If this sounds like a foreign language, or you just don't want to risk breaking your
• 6:54
  email, go to modularity.us We handle this exact setup for businesses every single
• 7:00
  day to make sure your invoices actually hit the inbox and you actually get paid.
• 7:05
  Let's make sure your cash flow isn't leaking through a dumb domain setting.
• 7:08
  Definitely.
• 7:09
  Alright, let's get back to work.