Someone is sending email as you. What it means and what stops it

A client calls. They got an email from you asking them to pay an invoice to a new bank account. You did not send it.

This is called spoofing. Someone typed your address into the "from" line of their own message. Email does not check that line by default, so it works.

What it means for you

Your inbox and your systems are fine. Nobody got into your account. What you have is a domain that does not tell the world who is allowed to send as you, so anyone can claim to be you and the receiving server has no way to say otherwise.

The cost lands on trust. Your client paid, or nearly paid, someone who used your name. That conversation is hard, even when the fault is not yours.

Why it keeps working

Spoofers go after small businesses because the checks are usually missing. Large companies publish a policy that tells servers to reject mail that fails to prove it came from them. Most small domains publish nothing, or a policy set to "watch only", which blocks nothing.

What stops it

Three steps, in this order:

1. List every service that legitimately sends as you.
2. Publish the records that say so, called SPF, DKIM and DMARC, and sign your messages.
3. Move the policy from "watch" to "reject" once the legitimate mail passes, so fakes are refused.

The order matters. Move to "reject" too early and your own invoices get refused. That is why this step tends to stall when owners try it alone.

What it costs to check

Nothing. Our free scan reads your domain, scores it out of 10, and shows which of the three steps are missing. If your domain has gaps, Domain Security is $25 a month per domain and a one-time $199 fix. A domain that already scores 10 pays no fix fee. No contract.

If a client has already been fooled, call them first, then run the scan.

Run the free scan on your domain →