For years, millions of people have trusted All Things Secured to provide them with timely...
“…we interrupt this video for a special announcement.
Did you know that you can make boatloads of money with this new crypto scheme everybody
is talking about?”
Wait a second, hold up!
I don’t endorse that at all.
[new email alert]
“You’ve won!
In order to claim your prize, you’ll need to send us your address, phone number, bank
account number, social security number...”
Stop it!
Please, don’t send all that info to anybody…
“This email is to inform you that All Things Secured just charged your credit card $256.
If you believe this was an error, please click on this…”
No, no, no!
Don’t click that button.
What’s interesting about being a creator - or any small business for that matter - is
that many times our greatest threat is not somebody stealing money or our data.
Rather, it’s somebody stealing the trust we’ve built with our customers and with
you, my audience.
This is what happened to my friend Justin Moore from Creator Wizard.
“I started getting a bunch of replies to my email, calling me a scammer.
Like, Hey, stop scamming me, like screw you, this type of thing.”
The crazy thing is that Justin had not been hacked.
But even if he had, what’s interesting is that the attacker wasn’t looking to harm
Justin.
The same can be said for Linus, whose massive YouTube channel was hacked in early 2023.
“The fireworks started a little after three in the morning when the Linus Tech Tips account
was renamed to Tesla and started streaming a podcast style recording of self-proclaimed
techno King Elon Musk discussing cryptocurrency.”
Poor Linus, right?
No!
Linus may have lost out on a small bit of ad revenue, but the real victims were the
likely hundreds or maybe thousands of people in his audience who clicked on a crypto scam
that they thought was legit.
Linus probably has insurance to cover his naked behind, but those people in his audience?
Not so much.
The attacker was stealing and exploiting the trust that Linus had built with his audience.
If we look again at my friend Justin, you can see how this can easily unfold.
“There was like this, oh, you have a shipping notification, click here to update your address
or whatever.
Obviously a scam.
And I had never sent out an email like that.”
Let’s stop there for a moment.
Did you realize how easy it is for somebody to impersonate you and send emails from your
domain?
One of the first things I tell people about avoiding scam email is to look at the from
address.
Is this address legit or is it misspelled?
But without the proper authentication, it’s scary easy for somebody to simply send an
email that gives every indication that it comes from your trusted domain.
I even had that happen to me earlier this year where I had some Russian IP address sending
emails from the AllThingsSecured.com domain.
I don’t know who received those emails, but hopefully they weren’t duped into believing
some scam just because they trusted the All Things Secured domain.
And while the important thing to consider is how this impacts customers and followers,
having tons of people start marking your email as spam doesn’t help you either.
“My biggest fear, if I did not figure this out, was that my reputation score with all
the email service providers would tank.”
Justin, like me and maybe you, has invested a lot in building an email contact list to
communicate directly with his audience and if email service providers like Gmail, Yahoo,
and others start to think that your domain isn’t trustworthy, they’re going to start
putting it in the spam folder.
Thankfully, when it comes to email, the solution is pretty simple and I’m going to see if
I can explain this in a way that pretty much anybody can understand.
And then once I’m done, I’ll share three important pieces of advice that I wish somebody
had told me when I was doing this.
Ok, imagine with me for a moment I’m sending an email to my friend Joe and this message
arrives at the door of his hypothetical inbox.
Now every inbox has a bouncer that decides what to do with all of this incoming mail.
Does it go straight to spam, does it go to the promotions folder, does it go into your
primary inbox?
And part of how the bouncer does his job is by authenticating the messages and who sends
them.
So first things first, I want to make sure that I’m on the trusted guest list.
This is the SPF, or Sender Policy Framework.
When an email is received, the SPF tells the email service like Gmail whether or not the
sender of that email is authorized to use that particular domain.
So I can’t send an email and pretend to be Amazon.com or Netflix.com because the SPF
record would indicate that I’m not authorized to use that domain.
Next, the bouncer checks the message itself.
The message I sent is sealed with a signature that allows the bouncer to verify that the
message wasn’t altered in any way during delivery and that it did come from the claimed
sender.
This is DKIM, which stands for Domain Keys Identified Mail, which digitally signs every
email message with my private key.
Finally, we have instructions for the bouncer.
Let’s say that somebody tries to get into this email party but uses a Fake ID or presents
a seal that has been tampered with.
The bouncer is given a set of rules that tells him what to do with that cheater.
This is DMARC, which stands for Domain-based Message Authentication Reporting and Conformance.
This set of rules for your specific domain, or your DMARC policy, informs the bouncer
that whenever a message from this URL is identified as fake, whether he should do nothing, whether
he should allow these emails in but move them to spam, or whether he should block them from
getting in altogether.
Even if this analogy doesn’t make complete sense to you, there’s one important thing
I want you to take away - NOT giving instructions to this bouncer, some kind of authentication
process for your email domain, isn’t just an oversight, it’s simply foolish.
The main reason that a lot of creators and small business owners don’t set up this
important authentication is often the same reason that I didn’t do it for the longest
time and why my friend Justin was hesitant.
“I was actually very intimidated because when I started just going down the Google
and YouTube rabbit hole of the various things that I needed to do to update those records,
it seemed as though everyone was like saying, be really, really careful when you start messing
with these records because it could mean that no one gets your emails.”
I’ve already done a video tutorial showing how you can set up these DMARC records on
your own, but the more that I talk to people, the more I realize that if you have your own
email domain, using a DMARC service isn’t just recommended, it’s almost necessary
at this point.
I don’t know anybody who has the time to analyze the flood of reports that come in
an XML format to understand what’s going on with your email authentication.
I want to offer three pieces of advice, but before I do, I’m going to try to make Justin
proud by sharing with you the DMARC service I recommend and who have graciously sponsored
this video.
After setting up my AllThingsSecured.com domain through EasyDMARC, I now have complete confidence
and peace of mind that my messages are being authenticated properly and that nobody else
can use my domain to steal the trust I’ve built with those who receive my emails.
The authentication boosts my authority with the email bouncers, which means my emails
are more likely to be delivered to your primary inbox, and it’s super-easy for me to monitor
the entire authentication and delivery process.
I can forget all of these confusing acronyms and just focus on what matters.
I trust EasyDMARC with my email domain and it’s surprisingly fast to get everything
set up.
You can sign up for free at EasyDMARC.com and get 10% off using the code ATSPROMO at
checkout.
Now that you’re ready to start protecting the trust that your email domain represents,
let me give you three pieces of advice.
First, you want to start with SPF and DKIM.
These are the two that require input from any place where you send emails.
That could be Google Workspace, Mailchimp, basically any service that sends emails using
your domain, they will provide you with all the stuff you need to set up these records
in your DNS.
Sometimes you don’t even realize which services do that, by the way.
It wasn’t until I started monitoring my EasyDMARC reports that I realized that my
website hosting service also sends emails via the contact form and if I wanted to receive
those messages, I needed to make sure that I included my website host in an SPF and DKIM
record.
All of this information has to come from the service itself, so a simple Google search
for “Mailchimp SPF” or “your website host SPF” should give you what you need.
My second piece of advice is to give you permission to ease your way into this.
As you get started, you might feel a bit like Justin did:
“I was just super confused.
I didn't know what to do to, I don't have a ton of experience with this…so it was
just, oh my God, it was so stressful.”
I get it!
I was too.
If you’re worried you’re going to screw something up, simply start with a DMARC policy
of “none”, which means that no actions are taken even if you set up all these SPF
and DKIM records incorrectly.
You can monitor your reports through a service like EasyDMARC to see if everything passes
correctly and then upgrade your security from there.
For example, I felt pretty confident that I had set up all my records correctly, but
I didn’t want to take any chances so I started with a DMARC policy of quarantine.
I monitored my DMARC reports every day just to see if any of the emails I was sending
were getting quarantined, but none of them were.
Everything was working as it should.
So after a couple weeks of testing it out, I moved to a DMARC policy of reject.
In the end, this is what you want to get to.
To fully secure your email against bad actors, you need to move to a DMARC reject policy.
Keeping a none or a quarantine is about as useful as keeping an iron safe in your home
but never locking it closed.
Finally, my last piece of advice is to put a reminder on your calendar or somebody on
your team to monitor your reports no less than once a month.
If you send out lots of emails you might want to keep an eye once a week.
The point here is that you want to know what’s happening with your email.
One of the things I like about using EasyDMARC is that they send me a message anytime an
email fails the DMARC check so that I can find out what’s happening.
Again, just that peace of mind knowing that I’ve done everything I can to protect my
email and anybody who receives my messages.
Make sense?
If not, leave a comment below or watch this video where I walk you through the process
step by step.
But honestly, the best thing you can do is go to EasyDMARC.com and create an account.
It’s free to start using and it will help you check if you’ve set up all these DMARC
records correctly.