> ## Documentation Index
> Fetch the complete documentation index at: https://help.tiretutor.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Understand what email security records protect in your shop, and what goes wrong when your domain has none.

Your shop sends email from your own domain name. Anyone can type your address into the From field of a message, and the internet carries it. Email carries no built-in way to check who sent a message.

Three DNS records fix that. They let the receiving mail system check that a message really came from you.

Nobody sets these up for you. If you never asked for them, your domain has none.

<Note>
  **Educational guidance.** Email security is not part of the TireTutor product, and TireTutor does not manage your mailboxes. These pages explain how it works so you can brief the right person.
</Note>

In a hurry? [Check what your domain already has](/dealers/email-security/getting-started). That takes about five minutes and needs no software.

## The three records

| Record | The question it answers | In plain terms |
| - | - | - |
| **SPF** | Which servers may send as us? | A public list of the mail services you approve |
| **DKIM** | Did anyone change this message? | A seal your mail server adds to every message |
| **DMARC** | What happens to fakes? | Your instruction to receivers, plus a daily report |

The order matters. DMARC acts on the results of SPF and DKIM. A DMARC record with no SPF or DKIM beneath it does nothing.

## What goes wrong without them

Nothing warns you. Your mail keeps sending. The damage lands at the other end, where you cannot see it.

### Someone can send email that looks like yours

This is the worst case, and it is not about your mail. A stranger sends a message from your shop address. It tells a customer or a supplier to pay a new bank account. The recipient has nothing to check it against.

### Suppliers stop receiving your mail

Large companies refuse mail that fails these checks. Warranty claims, parts orders, and credit applications are the mail most at risk, because big companies filter hardest.

Sometimes you get a bounce. Often you get silence, and both sides think the other never replied.

### Customer email drifts into spam

Estimates and reminders lose points with every mail provider. The decline is slow, so it looks like a different problem. Customers say they never got the estimate.

### You cannot find out who is forging you

DMARC reports list every system sending mail in your name. Without them, you cannot tell a forger from a tool your shop forgot about.

## Who looks after this

Owning a domain splits across separate companies. The company you last paid is often not the one who can help.

| Job | Usually |
| - | - |
| Your domain name | A registrar, such as GoDaddy or Namecheap |
| Your DNS records | A DNS host — sometimes the registrar, sometimes a separate company |
| Your mailboxes | Google Workspace or Microsoft 365 |
| Your website | A web host or a design agency |

Two of them matter here. Your email provider makes the DKIM key. Your DNS host publishes all three records. You usually need both.

Your website company is not your email company, unless they are the same business. Ask about DNS, not about your website. A web host does not set these records up for you.

<Warning>
  Anyone who can edit your DNS can redirect your incoming mail to themselves. They never need your password. Find out who holds that access.
</Warning>

## Where to go next

<Columns cols={2}>
  <Card title="Checking your setup" icon="magnifying-glass" href="/dealers/email-security/getting-started">
    Two free checks that show which records you are missing.
  </Card>

  <Card title="Getting the records set up" icon="user-gear" href="/dealers/email-security/managing-email-security">
    Find who manages your domain, and what to ask them for.
  </Card>
</Columns>