Block Inbound and Outbound Fraudulent Email Messages at your Payroll Company

Sep 14, 2022

Unfortunately, Payroll Service Bureaus are often the target of many bad actors who want to gain access to your data. They often do this in a very methodical targeted attack. As busy as we all are within our Payroll companies, there are ways to block these fraudsters from even getting in the front door.

There are underutilized email settings that can:

-Prevent bad actors from sending email messages impersonating your organization’s email address

-Prevent your workers from receiving emails from bad actors impersonating a legitimate sender

Please forward this message to your IT professionals and ask if someone configured your organization’s email to support SPF, DKIM, and DMARC. Your IT team can contact your email provider for assistance.

SPF: Gives receiving email servers an opportunity to confirm a message came from your email servers and not from a fraudulent email server.

DKIM: Uses an encrypted signature that gives receiving email servers an opportunity to confirm a message is from you and that nobody has changed the message since you sent it.

DMARC: Allows you to create policies that tell receiving servers to allow, reject, or send messages to a spam folder when SPF or DKIM fails validation.

DMARC can alert you when someone sends fraudulent email messages using your domain name.

Note: SPF, DKIM, and DMARC protect you based on the part of your email address after the at sign: yourcompanydomain.com. If someone receives an email message from your name at stumbling ballet dot com, they need to notice that’s not you. But sometimes, bad actors use a legitimate-looking address with a minor difference, such as changing one letter in the domain name.

Both the sending and receiving email servers must support SPF, DKIM, and DMARC. So, please forward this message to encourage all the other organizations you know to configure their settings.

Some organizations use free tools to make the process of creating the DNS records much easier. Example sites they use include:

There are many other sites too. Some use mxtoolbox.com to check all three records.