As an experiment, we ran the same checks we do for clients every day against a real batch of small businesses we came across — domains, email authentication, basic site hygiene. No company names, aggregate only.
85 had no DMARC record at all. This isn't just "someone could send an email that looks like it's from you." Here's the real version of this that happens: someone spoofs your domain and emails your own customers a fake invoice with a payment link. The customer pays it, thinks they're square with you, and moves on. You don't find out until your books don't match up weeks or months later — and by then, when that customer says "I already paid you," that's your problem to untangle, not theirs. You left the door open, whether you knew it or not.
18 had no DKIM signing configured at all. Same spoofing risk from a different angle, plus a second cost: your own real emails are more likely to get flagged as spam once they're forwarded — so your actual invoices start disappearing into junk folders on the other end.
15 were running business mail through a free email account (Gmail, Yahoo, etc.) instead of their own domain. Forget the technical risk for a second — it just looks sloppy. A customer sees "yourbusiness@gmail.com" instead of "you@yourbusiness.com" and reads it as "this person doesn't really know what they're doing." And if that free account ever gets shut down, the business can lose its whole email history with zero warning.
Smaller things worth mentioning: several sites had no privacy policy up while still collecting personal info through a contact form, a few had exposed plugin version numbers sitting right next to a login page nobody locked down, and a couple had copyright years or leftover placeholder text nobody's touched in years — small stuff, but it tells a visitor nobody's minding the store.
Most business owners have no idea any of this exists, let alone that it's checkable in a few minutes. None of it is exotic. It's just nobody's job to look.
Source: r/it_advice · by /u/trubetech