Email Security for Raleigh Small Businesses: Phishing, Spoofed Invoices, and SPF/DKIM/DMARC
Most of the security scares we get called about in Raleigh, Clayton, and Johnston County start the same way: an email. A "past due invoice" from a vendor, a shared document that asks you to sign in, or a message that looks like it came from the owner asking someone to buy gift cards before lunch.
Email is still the easiest way into a small business. Here's a practical guide to tightening it up without turning your inbox into a fortress nobody can use.
The email scams Triangle businesses actually see
You don't need to memorize every trick. Most attacks fall into a few patterns:
Credential phishing: a fake Microsoft 365 or Google sign-in page that captures your password
Spoofed or look-alike senders: mail that appears to come from your own domain, or from a domain one letter off, like "woodyscomputlng.com"
Fake invoices and payment changes: a "vendor" sends new bank details, or a real vendor's hacked mailbox replies in an existing thread
Boss impersonation: an urgent request from "the owner" for gift cards, a wire, or W-2s
Malicious attachments and links: "scanned document," "voicemail," or "shipping notice" files that install malware
The common thread is urgency. If an email is rushing you to pay, sign in, or keep something secret, slow down.
Spoofed invoices: the expensive one
Payment fraud is where a single email turns into real money lost. The pattern usually looks like this: a vendor or customer's mailbox gets compromised, the attacker watches the conversation, then replies at the right moment with "we've changed banks, please use this new account."
A few habits stop most of it:
Verify any change in payment details by phone, using a number you already have on file, never the one in the email
Require two people to approve new payees or wire changes
Watch for reply-to tricks, where the display name looks right but replies go to a different address
Be suspicious of new urgency on an old thread, especially near month-end or closing dates
This matters for every office, but it's especially important for real estate, construction, legal, and accounting firms around the Triangle that move large payments by email.
SPF, DKIM, and DMARC in plain English
These three DNS records tell the rest of the internet which mail really comes from your domain. Without them, it's much easier for someone to send email that looks like it's from you.
SPF lists the services allowed to send mail for your domain, such as Microsoft 365, Google Workspace, your website forms, or your invoicing tool.
DKIM adds a digital signature to your outgoing mail so receiving servers can confirm it wasn't forged or altered.
DMARC tells receiving servers what to do when a message fails those checks (watch it, send it to spam, or reject it) and sends you reports about who is sending as your domain.
Gmail, Yahoo, and Microsoft have all tightened their rules for senders, so missing or broken records can also mean your legitimate invoices and quotes land in spam.
Roll out DMARC without breaking your own email
The mistake we see most is jumping straight to a strict DMARC policy and accidentally blocking the CRM, payroll system, or website form that sends on your behalf. A safer path:
Take inventory of everything that sends as your domain, including Microsoft 365 or Google Workspace, your website, QuickBooks or other invoicing, newsletters, and phone system voicemail-to-email.
Fix SPF so it includes every legitimate sender, and stays under the DNS lookup limit.
Turn on DKIM in Microsoft 365 or Google Workspace, and in any third-party sender that supports it.
Start DMARC at p=none to collect reports for a few weeks without blocking anything.
Move to quarantine, then reject once the reports show only your real senders passing.
Tighten Microsoft 365 or Google Workspace
DNS records protect your domain's reputation. Your mailbox settings protect your people. In Microsoft 365 or Google Workspace, make sure you have:
Multi-factor authentication on every mailbox, including the shared ones and the owner's (see our password manager and MFA guide)
External sender warnings, so "[External]" shows up on mail from outside the company
Built-in anti-phishing and impersonation protection turned on and tuned for your owners and finance staff
Alerts for suspicious forwarding rules, a classic sign that a mailbox has already been taken over
Old protocols turned off, so attackers can't sneak around MFA with legacy sign-ins
Train people with short, real examples
Filters catch a lot, but something always gets through. The best defense is staff who pause before they click. Keep training short and practical:
Show real phishing emails your office has received, with the warning signs circled
Teach the "hover before you click" habit for links
Make it easy and blame-free to report a suspicious email, a quick forward to IT is enough
Run occasional simulated phishing tests, then use the results to coach rather than punish
What to do if someone clicks
Speed matters more than blame. If someone entered a password or opened a bad attachment:
Change the password right away and sign that user out of all sessions
Check for new forwarding rules and inbox rules the attacker may have added
Warn finance to hold any pending payment changes
Disconnect the computer from the network if an attachment was opened, and call your IT provider
Let vendors and customers know if your mailbox sent anything suspicious
Good cloud backups and the ransomware basics we covered earlier turn a bad click into an inconvenience instead of a disaster.
What Woody's Computing sets up
For managed IT and cybersecurity clients in Raleigh, Clayton, and eastern NC, an email security project usually includes:
A review of your domain's SPF, DKIM, and DMARC records, with a careful rollout to enforcement
Microsoft 365 or Google Workspace hardening: MFA, impersonation protection, external tags, and forwarding alerts
A simple payment-change verification process for your finance team
Short staff training built around the scams your office actually receives
A clear plan for what happens when someone clicks
Soft next step
Not sure whether your domain is protected, or why your invoices keep landing in spam? Contact Woody's Computing or call 919-795-9106 for a plain-language email security check for your Raleigh, Clayton, or Triangle business. We'll show you what's missing and what to fix first.
Comments