Can strangers send emails that look like they come from your company?

Often, yes. Most small companies haven't switched on a free setting (DMARC) that tells mail servers to block fakes. Here's how to check and fix it.

By Mihail Lupu, Builds bigWUF. Product marketer and AI builder making cybersecurity risks understandable and actionable for small businesses.. Published .

Yes, unless your company has switched on a free setting called DMARC. Without it, anyone can send an email that shows your company's address as the sender, and your customers' mail systems have no instruction to stop it. Switching it on costs nothing, takes your IT provider about an hour, and is done safely over a few weeks.

The setting that stops it, in one minute

Email was designed in the 1970s, when everyone on the network knew each other. Nothing in it checks that the sender is who they say they are. Three short public records in your domain's settings (DNS) fix that:

Record What it says Without it
SPF Which servers are allowed to send email for your domain Any server can claim to send for you
DKIM A signature proving the message really came from you and wasn't changed No proof the message is yours
DMARC What other mail servers should do with mail that fails both checks: deliver it, put it in spam, or reject it Most servers deliver the fake

SPF and DKIM are the evidence. DMARC is the instruction. Without DMARC, a receiving server can see that a message failed the checks and still has no policy from you on what to do about it.

Why small businesses are the target

The fake invoice is the oldest trick in business email, and still one of the most profitable. In its 2024 report, the FBI's Internet Crime Complaint Center counted $2.77 billion in reported losses from business email compromise, from 21,442 complaints. Only investment fraud cost more. Those are the cases people reported; most never are.

The usual version goes like this. A message arrives at one of your customers, from your address, saying your bank details have changed and the open invoice should be paid to a new account. It looks normal because it uses your real name and domain. If your domain has no DMARC policy, nothing in the customer's mail system stops it.

Small companies are attractive because they rarely have anyone checking this, and because one paid invoice is enough. The same works the other way round: a scammer pretending to be one of your suppliers. That's why it's worth asking your suppliers to set up DMARC too.

"We only send a few emails a day. Does this apply to us?"

The big mailbox providers made DMARC compulsory for bulk senders: Google and Yahoo from February 2024, Microsoft's Outlook.com from 5 May 2025, for anyone sending 5,000 or more messages a day to their users. You probably don't send that much, so those rules don't force you.

But the rules aren't the reason to do it. DMARC protects you from email you never sent: fakes in your name. Volume has nothing to do with that.

In Germany, the federal cyber security agency (BSI) goes further. Its technical guideline TR-03182 on email authentication treats SPF, DKIM and DMARC as the state of the art, and expects a policy of quarantine or reject, not just monitoring. If you sell to German companies or public bodies, expect to be asked about it.

How to check yours in a minute

Two ways:

  1. Run the free check at the end of this page. It reads your public records and tells you in plain words whether strangers can send email as you.
  2. Ask your IT provider to look up the TXT record at _dmarc.yourcompany.eu. No record means no DMARC.

If a record exists, the part that matters is the policy, p=:

Policy What it means Protection
No record Receivers decide for themselves None
p=none "Report failures to me, but deliver everything" Visibility only: fakes still arrive
p=quarantine "Put failures in spam" Good
p=reject "Refuse failures" Best

A lot of companies stop at p=none and believe they're protected. They aren't: none only collects reports.

The safe way to switch it on

Going straight to reject can block your own invoices if your accounting software sends email in your name and isn't set up yet. Do it in four steps over four to six weeks:

  1. List everything that sends email as you. Your mailbox provider (Microsoft 365, Google Workspace), the newsletter tool, the invoicing or accounting software, the online shop, the website's contact form, the booking system. Forgotten senders are the usual cause of problems.
  2. Set up SPF and DKIM for each of them. Each provider has a short help page for this. Keep one SPF record only, with no more than 10 lookups.
  3. Publish DMARC in monitoring mode, with reports. For example: v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.eu. Read the reports for two to four weeks, or use a report service, and fix any legitimate sender that fails.
  4. Tighten it. Move to p=quarantine, wait a week or two, then p=reject. Add sp=reject so your subdomains are covered too.

What to send your IT provider

Please set up DMARC for our domain. First check that SPF and DKIM pass for everything that sends email in our name (mailbox, newsletter, invoicing, website). Then publish DMARC with p=none and reports to us, review the reports for a few weeks, and move to p=reject. Please tell us when each step is done.

That's the whole job for most small businesses. If your IT provider says it's done, check again: the record should end up with p=reject or at least p=quarantine.

Common mistakes

  • Staying on p=none for good. It's a starting point, not protection.
  • Forgetting a sender. The invoicing tool is the classic one: invoices land in spam the day you switch to reject.
  • Two SPF records. Only one is allowed; with two, both are ignored.
  • Too many lookups in SPF. More than 10 and the check fails. Remove services you no longer use.
  • Not protecting subdomains and unused domains. A domain you own but never send from should say so: a DMARC policy of reject and an SPF record of v=spf1 -all.

Sources