Anyone Can Send Email as Your Company Until You Fix This

Email was designed in an era when the network was small and everyone on it was trusted. Nothing in the original protocol prevents a stranger from putting your company's address in the from field. The three technologies that fix this were bolted on afterward, they are free, and most small businesses have either not deployed them or have deployed them in a way that does nothing.

We check this on every domain we assess. The failure rate in the Phoenix market is high enough that it is worth writing down plainly.

The three parts, without jargon

SPF is a public list of the servers allowed to send mail for your domain. You publish it in DNS. A receiving mail server checks the list. If the mail came from somewhere not on it, that is a signal.

DKIM is a signature. Your mail server signs outgoing messages with a private key, and the matching public key is published in your DNS. The receiver verifies the signature, which proves the message was not altered and did come from a sender holding your key.

DMARC is the policy that ties them together and tells receivers what to do when a message fails. It also, and this is the part people miss, sends you reports about who is sending mail claiming to be you.

Without DMARC, SPF and DKIM produce signals nobody acts on. That is the most common configuration we find: both present, DMARC absent, and the practical protection close to zero.

The three states of a DMARC policy

None. Monitor and report, take no action. Useful for two to six weeks while you learn what your own mail flow looks like. Harmful as a permanent state, which is where most domains that have DMARC at all are sitting.

Quarantine. Failing mail goes to junk. This is where you start enforcing.

Reject. Failing mail is refused outright. This is the destination.

If your DMARC record ends in p=none, you have monitoring, not protection. An attacker spoofing your domain is unaffected by it.

Why rollout takes six weeks and not an afternoon

The reason people leave DMARC at none is that going straight to reject breaks things, loudly.

Your mail does not just come from your mail server. It comes from your invoicing platform, your CRM, your marketing tool, your appointment reminder system, your e-signature vendor, and the shipping notification service somebody connected in 2021. Every one of those sends on your behalf and every one needs to be authorized before you enforce.

The staged approach:

Weeks one and two, publish DMARC at none with a reporting address and read what comes back. The reports are XML and unpleasant to read raw, so use one of the free or low-cost report processors. You are building an inventory of legitimate senders you did not know about.

Weeks three and four, fix the senders. Add them to SPF, or better, set up DKIM signing for each one, since SPF has a hard limit on lookups that busy domains hit. Get every legitimate sender passing.

Week five, move to quarantine at a partial percentage if your provider supports it, then full quarantine. Watch for complaints.

Week six or later, move to reject.

Do not do this during your busiest month, and tell your marketing and finance teams before you start.

The domains people forget

Every domain you own needs a record, including the ones you never send from. A parked domain with no DMARC policy is a free identity for anyone who wants it, and typosquatted lookalikes of your domain are outside your control entirely. For non-sending domains the record is simple and takes ten minutes: an SPF record that authorizes nothing and a DMARC policy set to reject.

Also check your subdomains. A DMARC policy can be inherited or overridden by subdomain, and attackers know which configuration leaves a gap.

What this actually protects

Direct spoofing of your exact domain, which is used in invoice fraud and in phishing aimed at your own employees and customers.

It does not protect against lookalike domains, display name spoofing, or a genuinely compromised mailbox sending real mail from your real server. Those need other controls. DMARC closes one specific hole, and it is a hole that is trivially exploited while it is open.

There is also a deliverability benefit. Major providers have tightened bulk sender requirements, and properly authenticated mail lands in inboxes more reliably. Companies that fix this frequently see their own legitimate mail perform better.

Get the planner

The DMARC Rollout Planner is a six-week worksheet with a sending source inventory, the exact DNS record syntax for each stage, an SPF lookup counter so you do not exceed the limit, a subdomain and parked domain register, and a go or no-go checklist for each enforcement step.

You can also run our free external scan, which checks SPF, DKIM, and DMARC on your domain from the outside and returns exactly what an attacker would see when they look. There is no call attached to it, and there is a button to tell us never to contact you.

Frequently asked questions

What is the difference between SPF, DKIM, and DMARC?

SPF is a published list of servers allowed to send mail for your domain. DKIM is a cryptographic signature proving a message was not altered and came from a sender holding your key. DMARC is the policy that ties them together, tells receivers what to do on failure, and sends you reports about who is sending as you.

Is p=none enough for DMARC?

No. A DMARC record ending in p=none provides monitoring and reporting but takes no action, so an attacker spoofing your domain is unaffected by it. This is the most common configuration we find: SPF and DKIM present, DMARC at none, and practical protection close to zero.

How long does DMARC implementation take?

About six weeks done properly. Two weeks monitoring at p=none, two weeks authenticating the third-party senders you discovered, one week staging through quarantine, then reject. Going straight to reject breaks invoicing platforms, CRMs, and appointment reminder systems loudly.

Do parked domains need DMARC?

Yes. A domain you own but never send from is a free identity for anyone who wants it, and nobody is watching it. The record is simple: an SPF record authorizing nothing and a DMARC policy set to reject, plus a null MX record.

Related reading

• Your AI Tools Have Logins Now, and Nobody Is Managing Them
• The Voice on the Phone Is Not Your CFO
• MFA Stopped Being Enough About Two Years Ago
• The Microsoft 365 Settings Most Phoenix Businesses Never Turned On
• Your Weakest Security Control Belongs to Somebody Else
• Offboarding an Employee in 60 Minutes