There is a category of attack that needs nothing from you. No password, no phishing link clicked, no software installed. The attacker sends email that appears to come from your domain, to your clients, and your systems are never involved.
Whether that works against your business is decided by three DNS records. Most small businesses have never looked at them.
Why can email be forged so easily?
The “From” address on an email is not verified by the protocol itself. It is a label the sender writes. Email was designed in an era of mutual trust between a small number of known hosts, and that assumption was never removed — it was patched over.
The patches are SPF, DKIM and DMARC:
- SPF publishes which servers are allowed to send mail for your domain.
- DKIM cryptographically signs your outgoing mail so tampering is detectable.
- DMARC ties the two together and, crucially, tells receiving mail servers what to do when a message fails — and where to report it.
DMARC is the one that matters, because without it the first two are advisory. A message can fail SPF and still land in the inbox if nothing instructs the receiver to reject it.
How many businesses are actually protected?
Fewer than you would hope. Depending on the sample, somewhere between two thirds and four fifths of domains have no effective DMARC protection — either no record at all, or a record set to “monitor only,” which reports problems without stopping anything.
The gap between large and small organisations is stark. Among the Fortune 500, the overwhelming majority publish DMARC and most enforce it. Among fast-growing mid-market firms, the enforcement rate is a fraction of that. Small businesses sit further behind again.
This is worth sitting with: the enforcement gap is not a technology gap. DMARC is free. It is a knowledge and attention gap.
How do I check my own domain?
If you are comfortable in a terminal, one command answers it:
dig +short TXT _dmarc.yourdomain.com
Read the result like this:
- Nothing returned — you have no DMARC record. Anyone can send mail as your domain and nothing will stop it.
p=none— monitoring only. You may be collecting reports, but forged mail is still being delivered.p=quarantine— failing mail goes to spam. A real improvement.p=reject— failing mail is refused outright. This is the goal.
If you would rather not use a terminal, our free domain exposure report checks the same records and explains what it finds.
Who gets hurt when a domain is spoofable?
Usually not you directly — which is exactly why it goes unfixed for years. The people who get hurt are the ones who trust your name:
- Law firms and title companies. Forged wire instructions sent to a buyer days before closing. The money is gone before anyone calls to check.
- Property managers. A fake invoice from a vendor the office genuinely uses, with the bank details changed.
- Accounting firms. A request to a client for documents that contain everything needed for identity theft.
- Any business with suppliers. A payment redirect that looks like it came from your accounts department.
By the time you find out, your client has lost money and your name was the instrument.
Why do businesses not just turn it on?
Because getting to p=reject badly will stop your own legitimate mail, and everyone has heard a story about that. The risk is real and it is manageable.
The reason it goes wrong is that most businesses send mail from more services than they remember: the mail platform, an invoicing tool, a CRM, a marketing platform, the website contact form, a scheduling system. Every one of those needs to be authorised before enforcement is switched on.
The correct sequence is unglamorous and reliable:
- Publish DMARC at
p=nonewith a reporting address. Change nothing else. - Read the reports for two to four weeks. They will show you every service sending as your domain — including at least one you had forgotten.
- Fix SPF and DKIM for each legitimate sender.
- Move to
p=quarantine, watch, then top=reject.
Four to six weeks end to end, mostly waiting. The failure mode is skipping step two.
One more reason this now matters
Google, Yahoo and Microsoft have all tightened their requirements for bulk senders. Authentication that used to be good practice is increasingly a condition of delivery, and Microsoft in particular now rejects non-compliant mail outright rather than filing it as spam.
Put plainly: an unauthenticated domain is starting to have trouble delivering its own legitimate email, quite apart from the forgery problem.
Check yours
Run the command above, or use the domain exposure report. It takes a minute, and it is the single highest-value minute most small businesses can spend on security this year.
If the result is not p=reject, email authentication is part of every managed plan we run, and we will walk it through the staged rollout rather than flipping a switch and hoping.