No malware, no breach, no stolen password. If your DNS does not forbid it, anyone can put your company in the From line — and your customers have no way to tell.
This is the attack that catches businesses who think they are too small to be interesting. It needs no access to your systems at all. It works because email was designed in an era when nobody expected the sender to lie, and the fix is a set of DNS records most small businesses have never been told about.
What actually happens
An attacker sends an email with your company name and address in the From line. Your customer receives an invoice that looks like yours, with different bank details. Or your bookkeeper receives a request from the owner's address to change a supplier's payment information.
Nothing was hacked. The message simply claims to be from you, and nothing in your DNS tells the receiving mail server to disbelieve it.
This is the mechanism behind business email compromise, which costs American businesses more each year than ransomware does.
The three records, and what each one really does
SPF, DKIM and DMARC get discussed as a set, which hides the fact that they do quite different jobs — and that two of them do not stop impersonation on their own.
| Record | What it does | Does it stop spoofing? |
|---|---|---|
| SPF | Lists which servers may send mail for your domain. Checked against the hidden envelope sender, not the visible From address. | No, not by itself |
| DKIM | Cryptographically signs your outgoing mail so tampering is detectable. Survives forwarding better than SPF. | No, not by itself |
| DMARC | Ties the two together, checks them against the visible From address, and tells receivers what to do on failure. | Yes — this is the one |
Why 'we already have SPF' is not the answer
This is the single most common misunderstanding, and it leaves businesses confident and exposed at the same time.
SPF validates the envelope sender — a hidden address used during delivery. The From line your staff and customers actually read is a different field entirely. An attacker can send from a domain whose SPF they control, pass the SPF check cleanly, and still display your company in the inbox.
DMARC is what forces the visible From address to line up with something that passed. Without it, SPF is a lock on a door nobody uses.
The part that goes wrong
Publishing a strict DMARC policy on Monday morning is how you stop your own invoices being delivered. Most businesses send legitimate mail from more places than they realise: the accounting system, the booking platform, the newsletter tool, the review-request service, the practice management software.
Every one of those has to be authorised before you tell the world to reject anything that fails. Do it in the wrong order and you will spend a week wondering why customers say they never received the quote.
How to do it safely
- Publish DMARC at p=none first. This changes nothing about delivery — it only starts collecting reports.
- Read the reports for a few weeks. They show every source sending as your domain, including the ones nobody remembered.
- Authorise the legitimate senders in SPF, and enable DKIM signing with each platform that supports it.
- Move to p=quarantine once the reports show your real mail passing consistently.
- Move to p=reject. Only now is impersonation actually blocked.
- Keep reading the reports. New tools get added to businesses all the time.
Two other things worth closing at the same time
Block external auto-forwarding on your mail tenant. When an attacker does compromise a mailbox, a quiet forwarding rule is how they watch a deal for weeks before striking at the moment money moves.
Make verbal verification a rule for any change of payment details, on a number you already had — never a number supplied in the email requesting the change. No technical control substitutes for that one.
Check where you stand
You can see your own position in about two seconds. Our free email security check reads your live SPF, DKIM and DMARC records and grades them, with no signup. Most small businesses fail it, and the failure is nearly always DMARC missing or left in monitoring mode.
Frequently asked
Does this cost anything to fix?
The records themselves are free — they are DNS entries. The cost is care and sequencing, because doing it carelessly interrupts your legitimate mail.
How long does it take?
The first record takes minutes. Getting safely to full enforcement typically takes a few weeks, because you need real report data in between each step.
We use Microsoft 365. Are we covered automatically?
No. Microsoft 365 publishes a default SPF include for you, but DMARC is not configured by default and DKIM signing usually has to be switched on. A brand new tenant is spoofable out of the box.
What if we do not send email from our domain at all?
You still need the records. A domain that never sends mail is an easy one to abuse, and it can be locked down harder precisely because there are no legitimate senders to accommodate.