Your clients trust email that comes from you. That is exactly why attackers want to send email that looks like it came from you. They do not need to break into your network to pull this off. They just need to borrow your name, point it at the people who already pay you, and wait for someone to update their banking details.
This is one of the quieter risks in small business IT, and one of the few where the fix is a handful of DNS records rather than a six month project. Below we explain how business impersonation works, what SPF, DKIM, and DMARC each do, how to check your own domain today, and how to reach enforcement without blocking your own invoices.
Two Different Tricks, One Goal
Think of your domain name as your front door. There are two ways someone shows up pretending to live there.
- The lookalike domain. The attacker registers a domain that reads like yours at a glance, swapping a letter, adding a hyphen, or changing the ending. It is a different house on the same street with your name on the mailbox. They own it, and there is nothing on your end to break into.
- Direct spoofing of your real domain. The attacker sends mail that claims to come from your actual address. This works because of how email was designed decades ago. As the Federal Trade Commission put it in its 2017 staff perspective on email authentication, the underlying mail protocol only requires that the address in the To line be valid, and all of the other information in the message can be false.
You cannot stop someone from registering a lookalike domain. You can stop the world from sending mail that claims to be your real one, and that is what the next three records do.
What SPF, DKIM, and DMARC Each Actually Do
These three get bundled together, which makes people assume they are versions of the same thing. They are not. Each does one job. Here is each in a sentence, using the definitions the Cybersecurity and Infrastructure Security Agency publishes.
- SPF is the guest list. CISA describes it as an authentication protocol that lists the addresses in a DNS record authorized to send email on behalf of your domain, so a receiving server can check whether that sender belonged there.
- DKIM is the tamper seal. CISA describes it as adding a digital signature to email headers to ensure the content has not changed, so the receiving server can confirm the message came from you and was not altered in transit.
- DMARC is the instruction to the doorman. CISA describes it as a protocol that uses SPF and DKIM to validate the sender and block fraudulent messaging, which means it tells receiving servers what to do with failures and asks them to report back to you.
CISA is explicit that these are not standalone tools. Its guidance states they are not intended to work in isolation and should be implemented together.
Why an Unprotected Domain Lets Anyone Send as You
With no DMARC record, receiving servers have no instruction from you about what to do with mail that fails authentication. Some filter it anyway. Many let it through. Your client sees your company name in the sender field and reads it like any other message from you.
Having a record is not the same as being protected, and this is where most businesses stall. DMARC has three settings: none, quarantine, and reject. None only collects reports. Quarantine sends failures to junk. Reject refuses them. Only the last two stop anything.
That gap is not new. When the FTC surveyed 569 major online businesses for that 2017 report, most had an SPF record published, but fewer than one in ten used the strongest DMARC setting that tells receiving servers to reject unauthenticated messages. Most had done the easy half and stopped.
There is a deliverability angle too. Google’s published sender requirements for Gmail ask every sender to set up SPF or DKIM, and require senders of large daily volumes to have all three in place. Skipping authentication increasingly means your legitimate mail lands in junk. Same pattern we described in our piece on AI powered attacks: the basics quietly became mandatory while everyone watched the flashy threats.
How to Check Your Own Domain Today
This takes about fifteen minutes and requires nothing technical.
- Find out who controls your DNS. Usually your registrar, your web host, or a service like Cloudflare. If nobody in the building knows, that is finding number one and it matters more than the rest of this list.
- Look for an SPF record. A TXT record on the root of your domain whose value starts with v=spf1. None means nothing is publishing a guest list. Two is a misconfiguration worth fixing.
- Look for a DMARC record. It lives at a host name of _dmarc followed by your domain, and its value starts with v=DMARC1. Read the p= part. If it says p=none, you are monitoring only.
- Confirm DKIM signing is on. This lives in your mail platform settings rather than being obvious in DNS. In Microsoft 365 and Google Workspace it is a switch in the admin console.
- List every system that sends mail as you. Your mail platform is only the start. Accounting software, scheduling tools, marketing platforms, ticketing systems, web forms. Each one wearing your domain name has to be accounted for.
Reaching Enforcement Without Breaking Your Own Email
Here is the honest reason so many businesses sit at p=none forever. Someone read that reject is the strong setting, flipped it on, and the next morning the payroll notifications vanished. Then they turned it off and never touched it again. CISA’s guidance advises validating records before deployment so legitimate email does not get flagged. The way through is staged, and boring on purpose.
- Inventory first, change nothing. Build the sender list from step five above. Guessing at this list is what breaks email.
- Publish DMARC at p=none with reporting on. Delivery does not change. The daily reports start flowing so you can see who is sending as you.
- Read the reports for a few weeks. You will find senders you forgot about. Almost everyone does. You may also find genuine abuse.
- Fix each legitimate sender. Add it to SPF or, better, get it signing with DKIM. Retire the ones nobody uses.
- Step up to quarantine, then reject. Watch the reports at each stage. If something legitimate starts failing, you see it there before you hear it from a client.
Handle the lookalike side separately. Watch for newly registered domains that resemble yours, register the obvious variants yourself, and make sure your team verifies any request to change payment details by phone, using a number you already had on file.
The Bottom Line
Your domain is an asset your clients trust, and right now it may be one anyone can borrow. SPF says who may send. DKIM proves the message was not tampered with. DMARC tells the world what to do when those checks fail. Left at the default they protect nobody. Taken to enforcement carefully they close a door that is standing open, which is exactly the argument we made about why cybersecurity is no longer optional for mid sized businesses.
If you are not sure what your domain publishes, or you tried enforcement once and it broke something, we can run the inventory, read the reports, and walk your domain to enforcement without the drama. We do this for businesses across Denton County and the wider DFW area. Contact us today.
Sources:
Comments are closed