Someone sends fake emails with your domain (spoofing)

What it means

Email was designed without proof of who the sender is. Anyone can write your address in the From line, just like anyone can write any return address on a paper letter. This is called spoofing.

Signs that it is happening to you:

• You receive bounces for emails you never sent.
• Customers or partners tell you they received strange invoices, payment requests or links "from you".
• DMARC reports show servers you do not know sending with your domain.

Why it matters

Spoofed emails are used for phishing and invoice fraud. They hurt your customers and your brand, and they can damage your domain's reputation with mailbox providers.

Note: if your own mailbox was hacked, the emails really come from you. Change the password, turn on two-factor login and check forwarding rules first.

How to check

• Use the Domain scanner at /domain-scanner: check that SPF, DKIM and DMARC exist, and look at your DMARC policy.
• Read DMARC reports: they list every IP that sent email with your domain and whether it passed. Delivmail DMARC monitoring, in the paid dashboard, receives and summarizes them for you.
• If you have a suspicious email, look at its headers: an email that fails SPF and DKIM for your domain is not yours.

How to fix it

1. Set up SPF and DKIM for every service that legitimately sends for you.
2. Publish DMARC in monitoring mode if you do not have it yet:

   _dmarc.yourdomain.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

3. Read the reports for two to four weeks. Sort sources into "mine" (fix their SPF or DKIM) and "not mine" (spoofing).
4. Move to quarantine once all your real senders pass:

   v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com

5. Then move to reject, which tells receivers to refuse spoofed emails:

   v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com

6. Protect your other domains: domains that never send email should have v=spf1 -all and a DMARC record with p=reject.
7. Keep monitoring. New tools you add later must be authenticated, or p=reject will block them.

What DMARC cannot do

DMARC protects your exact domain. It does not stop lookalike domains such as yourdomaín.com or yourdomain-billing.com. Warn your customers, and report fake domains to their registrar.

Check that it is fixed

DNS changes are not instant. Most are visible within a few minutes, but some providers take up to 24 to 48 hours.

Run the Domain scanner again: the DMARC policy should show reject. Send a test email from the home page to confirm your own emails still pass. Over the following weeks, DMARC reports should show spoofed emails as rejected.