The first sign is usually a bounce message for an email you never sent. Or a customer forwards you something that appears to come from your address, asking whether it is genuine. It is not, and you have not been hacked.

Nobody broke into anything

The from line on an email is not verified by default. It is closer to the return address written on the back of an envelope: anybody can write anything there. Putting your domain in it requires no access to your systems, no password, and very little skill.

That is worth understanding clearly, because the instinct on discovering this is to change every password in the business. It will not help, because none of your passwords were involved.

Why it matters even when the emails are obvious fakes

  • Your reputation absorbs the damage. Spam sent using your domain teaches receiving servers that your domain sends spam. Your genuine quotes then get filtered too.
  • Your customers get defrauded in your name. The most costly version is invoice fraud: a convincing email from your address, with your signature, giving new bank details.
  • You find out last. The messages never touch your servers, so nothing in your systems logs them.

The record that actually stops it

SPF says which servers may send as you. DKIM signs your genuine mail so it can be verified. Neither of them, on its own, tells a receiving server what to do when a message fails the check. That is DMARC, and it is the one that does the stopping.

A DMARC policy set to reject tells receiving servers to refuse mail that fails, which means the forgery does not reach the inbox at all. Most people who have DMARC at all have it set to do nothing, which is a monitoring setting rather than a defence.

Do it in the right order

There is a real trap here. Turning on a strict DMARC policy before your own legitimate senders are correctly listed in SPF and signing with DKIM will block your own email. Your invoices stop arriving, which is worse than the problem you set out to solve.

The sane order is: publish SPF listing every service that sends on your behalf, get DKIM signing working, confirm your genuine mail passes, then tighten DMARC from monitoring to quarantine to reject. It is a few weeks of patience rather than an afternoon, and the patience is the part that keeps your own mail flowing.

Then keep watching

The most common way businesses end up exposed again is not an attack. It is a new tool that sends email on their behalf, added months later by somebody who had no reason to know about SPF. We check all three records every week and tell you when one changes.