Your email should arrive. Your domain should be harder to impersonate.
Two things quietly went wrong for small businesses lately: legitimate email started landing in spam folders, and criminals kept sending invoices that look like yours. Both come down to the same handful of DNS records — records most businesses set once, years ago, and haven't looked at since.
Merula watches those records continuously, explains what they mean in plain language, and tells you — calmly — when something needs attention.
The big mailbox providers changed the rules
The companies that receive most of the world's email now expect senders to authenticate. The strictest SPF, DKIM and DMARC rules are written for bulk senders, but weak or missing authentication can send any domain's mail to spam — or see it refused outright. This isn't a future risk; the requirements are already in force:
- February 2024 — Gmail and Yahoo
- Bulk senders must authenticate with SPF, DKIM and a DMARC policy. Unauthenticated mail is increasingly filtered or rejected.
- May 2025 — Microsoft Outlook and Hotmail
- Domains sending 5,000 or more messages a day must pass SPF, DKIM and DMARC; since 5 May 2025 mail that fails those checks is rejected outright, not just filtered.
- And for everyone else
- The published thresholds describe bulk senders, but authentication affects senders of every size — a small sender with broken authentication meets the same spam folder. A quote that lands in spam is a quote that doesn't get answered.
Three records decide whether receivers can trust your mail
None of this requires new software — it's a few DNS records on the domain you already own:
A public list of who is allowed to send email for your domain — your mail provider, your invoicing tool, your newsletter service. Receivers check the list.
A signature on each message proving it wasn't altered and really came from your domain. Your providers sign; receivers verify.
Your published instruction for what receivers should do when a message fails the first two — deliver it anyway, quarantine it, or reject it. It's also how you ask receivers to report what they're seeing.
Merula checks all three continuously, shows you what's weak or missing, and walks you through fixing it with step-by-step guides — included on every plan, written for people who don't do DNS for a living.
Make your domain harder to impersonate
The same records that get your mail delivered are what makes direct domain spoofing harder. A domain without an enforced DMARC policy is a domain that is easier to impersonate — for fake invoices to your customers, password resets to your staff, quotes to your suppliers.
Getting from "no policy" to an enforced policy is a staged journey — move too fast and you can block legitimate mail. Merula shows your published policy and uses received reports to help assess the next step. DMARC reduces direct domain spoofing; it does not stop lookalike domains, misleading display names or mail sent through a compromised account.
DMARC Analytics explains the sources and authentication results in aggregate reports sent by participating receivers. It is included in Pro without report-volume limits. Add Merula’s reporting address to your DNS record to receive reports. Coverage depends on which receivers report, and reports can arrive late; they do not account for every message or prove that an authenticated sender is legitimate.
And once those reports are flowing, Merula keeps watching them too: if a domain that has been reporting reliably goes quiet — usually a sign the configuration slipped — Merula surfaces that silence, rather than leaving you to discover the gap later.
Recognised guidance points the same way. The UK's National Cyber Security Centre recommends SPF, DKIM and DMARC to make a domain harder to spoof, and moving to an enforced policy in stages rather than all at once — the same road Merula walks you down.
Further reading: NCSC: Email security and anti-spoofing ↗
Set it up once. Hear about it when it matters.
Add your domain, and Merula runs the full set of checks — email, certificates, DNS, the web basics — on a recurring schedule. When something genuinely needs you, you get one clear message: what changed, why it matters, what to do.
Free includes one domain, all checks, seven days of history and critical email alerts. Paid plans also provide daily or weekly email digests for non-critical findings, webhooks to Slack or Microsoft Teams, and baselines for accepting expected changes. Webhooks are sent when alerts are created, rather than held for an email digest.
The Free plan covers one domain with every check included. No card, no trial clock — start there, and grow when the business does.