The scam that borrows your name
Email spoofing means a criminal sends messages with your business name and email address in the From line, with no hacking of your account required. The email system was designed in an era of trust, and by default it lets anyone claim to be anyone.
The damage lands on your reputation: a customer receives a fake invoice that looks like it came from you, pays it, and the relationship rarely recovers. Contractors and professional firms are favorite targets because their emails routinely contain payment instructions.
Three free settings, called SPF, DKIM, and DMARC, tell the world's mail servers how to spot fakes wearing your name. Most small businesses have them missing or half-configured, and checking takes about five minutes.
SPF, DKIM, and DMARC without the jargon
All three live as small text records in your domain's DNS, the public directory that tells the internet where your website and email live.
- SPF is your approved sender list: it names the servers allowed to send email for your domain, like a guest list at a door.
- DKIM is a tamper-evident seal: your mail service signs each outgoing message so receivers can verify it truly came from you and was not altered along the way.
- DMARC is the instruction card: it tells receiving servers what to do with messages that fail those checks, whether to deliver anyway, send to spam, or reject outright, and it mails you reports about who is sending as your domain.
SPF and DKIM do the checking. DMARC decides the consequences. Without DMARC, the first two are cameras with no guard watching them.
Check your own domain in five minutes
- Search for a free domain checker, MXToolbox is a well-known one, and run your domain through its SPF, DKIM, and DMARC lookups.
- SPF: you want exactly one record, ending in ~all or -all. No record, or one ending in +all, means anyone can send as you.
- DKIM: this is switched on inside your email provider. Both Google Workspace and Microsoft 365 have a settings page for it, and it is genuinely a few clicks.
- DMARC: look for a record starting with v=DMARC1. No record at all is the most common finding, and it means failures carry no consequences.
Write down what you find. Missing records are a to-do list, not an emergency. The fix is cheap and permanent.
What enforcement mode to aim for
DMARC has three policy levels, and the path through them matters.
- p=none: monitor only. Fakes still get delivered, but you receive reports showing every server sending as your domain. Start here.
- p=quarantine: failing messages go to spam.
- p=reject: failing messages are refused outright. This is the destination.
Run p=none for two to four weeks and read the reports first, because they reveal every legitimate service sending as you: the newsletter tool, the invoicing app, the CRM, including ones you forgot about. Add each to SPF and DKIM, then step up to quarantine, then reject. Jumping straight to reject without that homework is how businesses accidentally block their own invoices, which brings us to the main caution.
Do not break your own email
Nearly every DMARC horror story is self-inflicted: a business flips to reject, and suddenly their appointment reminders from the booking system or receipts from the payment platform vanish, because those services were never added to the approved list.
Before enforcing, inventory everything that sends email on your behalf: your mail provider, newsletter platform, invoicing and accounting software, CRM, website contact forms, scheduling tools. Each one needs to be included in SPF or signing with DKIM, and every reputable service publishes instructions for exactly this.
The DMARC reports make this inventory much easier, which is another reason to monitor before you enforce. Done in the right order, enforcement is uneventful: customers simply stop being spoofable targets, and your legitimate mail often delivers better than before.
What to do next
- Run your domain through a free checker today and note which of the three records exist.
- Turn on DKIM in your email provider's admin panel.
- Publish a DMARC record at p=none with a reporting address, and let it collect data for a few weeks.
- Add every legitimate sending service to SPF and DKIM as the reports reveal them.
- Move to quarantine, then to reject.
If DNS records are not something you ever want to touch, this is about an hour of work for someone who does it regularly. It is one of the first things I check for every new HashWhales client, because it is the rare security fix that is free, permanent, and invisible to your customers.