Can somebody send email pretending to be your business?

Most business owners assume that only they can send email from their own address. It feels like a phone number: yours, and nobody else’s.

It is closer to the address on an envelope. Anybody can write it. What stops a forged letter is the person opening it checking whether it really came from you, and with email that check depends on three records you publish in your domain’s settings. If they are missing, or set to watch rather than act, a forged email from your address can arrive in your customer’s inbox looking exactly like the real thing.

What does a forged email from your domain look like?

Usually it is an invoice. A customer gets an email from your accounts address, with your name at the bottom and your logo in the signature, saying your bank details have changed. They pay the next invoice into the new account. You find out when you chase it.

Nobody broke into anything to do that. They sent an email and typed your address into the From line. It is the same payment diversion behind Friday afternoon fraud in conveyancing, without the bother of getting into anybody’s mailbox first, and it is your name on it.

What are SPF, DKIM and DMARC?

Three public records that let any email system tell a message that really came from you from one that only claims to.

• SPF is your list of services allowed to send email as you. Microsoft 365, your accounts package, your newsletter tool, the booking system. Email from a server that is not on the list fails.
• DKIM is a signature your email system adds to every message, checked against a key you publish. It proves the message came from you and was not changed on the way.
• DMARC is the instruction that ties them together. It tells the receiving system what to do with an email that claims to be from you and fails both checks: let it through, send it to junk, or refuse it.

SPF and DKIM on their own produce a verdict that nobody is told to act on. DMARC is the part that gives the verdict consequences.

How do you check yours?

Put your domain, the part after the @ in your email address, into our free DMARC and SPF checker. It looks up all three records, tells you in plain English what each one says, and gives you the fix for anything missing. Nothing is stored.

The line to look at first is DMARC.

• No record at all means nothing tells anybody to stop a forgery.
• p=none means the same, with reports. It is where everybody should start, and where far too many businesses stay.
• p=quarantine sends forged email to junk.
• p=reject stops it being delivered at all. This is where the National Cyber Security Centre says every domain should end up.

Why not switch straight to reject?

Because the first thing it would block might be your own email.

Every business has more systems sending email as it than it thinks. The accounts package that emails invoices. The newsletter tool somebody set up three years ago. The booking system, the CRM, the scanner in the corner that emails PDFs. If any of those is not in your SPF record or signing with DKIM, an enforced DMARC policy treats it as a forgery, and your invoices stop arriving without anybody telling you.

So it goes in steps:

1. Publish p=none with a reporting address. Receiving systems start sending you daily reports of every server that sent email as your domain, and whether it passed.
2. Read the reports for a few weeks. Every genuine service that fails gets added to SPF or set up with DKIM. Anything you do not recognise is worth a closer look.
3. Move to p=quarantine. Watch the reports again.
4. Move to p=reject.

The reports are XML files and nobody enjoys reading them raw. There are services that turn them into something readable, and that is most of the work we do when we set this up for a client.

Does any of this affect whether your email arrives?

Increasingly, yes. Since February 2024 Gmail has required anybody sending more than 5,000 messages a day to its users to authenticate their email properly, and in May 2025 Outlook.com started sending email to junk from high volume senders without SPF, DKIM and DMARC in place. You are very unlikely to send 5,000 emails a day. It tells you which way the big mailbox providers are heading, and a domain with all three records in order is one they have every reason to trust.

What does it cost to fix?

The records themselves cost nothing. They are a few lines of text in your domain’s DNS settings, wherever the domain is registered.

What it costs is attention: finding everything that sends as you, getting each one right, and reading the reports until you are confident. For most small businesses that is a few hours spread over a few weeks. If you would rather somebody else did it, it is part of what we do, and I would rather you did it yourself than left it at p=none.