Someone is sending email from your domain: what to do right now

Spoofed or hacked? Tell them apart

The message itself is the best evidence. Ask the person who received it to forward it as an attachment or send you its full headers (in Gmail, More → Show original: Gmail Help; in Outlook, view the message headers). Find the Authentication-Results header:

• dmarc=fail, on a message that didn't come from you or any service you use: it was forged.
• dmarc=pass: it went through a server that's allowed to send for your domain. That's one of your accounts, or a service someone set up, such as an invoicing or newsletter tool. Treat it as a possible hacked account until you've ruled that out.

An empty Sent folder doesn't rule out a hacked account: Microsoft lists missing or deleted email among the signs of one.

If an account was hacked: lock it down first

Do this before anything else, from a device you trust. Microsoft's guide for business mailboxes and Google's steps for a hacked account cover the same ground (Microsoft; Google):

1. Change the password to a new, unique one. Don't send the new password by email, since the attacker may still be reading it.
2. Turn on multi-factor authentication, and remove any sign-in methods or devices you don't recognize. CISA calls security keys and passkeys the phishing-resistant option (CISA).
3. Sign out every other session and device.
4. Delete inbox rules, filters and forwarding you didn't create.
5. Remove apps you don't recognize that have access to the account.
6. Check whether anyone sent your bank, customers or suppliers new payment instructions in your name.

If an IT person or provider manages your email, call them now: in Microsoft 365 and Google Workspace, some of these steps need an admin.

If you were spoofed: what SPF, DKIM and DMARC do

Email's delivery protocol doesn't verify senders: as Microsoft's documentation puts it, SMTP by design makes no effort to validate that the sender is who they claim to be. The FTC warns that without email authentication, scammers can use your domain name for phishing emails that look like they came from you. Three DNS records are the fix:

The key idea is alignment: a message passes DMARC only if SPF or DKIM passes for your domain, the one in the From address, or by default one of its subdomains (RFC 9989 §3.2.10; Microsoft). Without that check, a scammer can pass SPF with a domain they own while showing yours (Microsoft).

Check your domain in five minutes

Open Terminal on a Mac, or Command Prompt on Windows, and run the lookups below with your own domain in place of example.com. Prefer a browser? Google's free Admin Toolbox Dig does the same lookups.

1. SPF

nslookup -type=TXT example.com

Find the line that starts with v=spf1. There should be exactly one.

2. DMARC

nslookup -type=TXT _dmarc.example.com

Look for v=DMARC1 and note the p= value.

3. DKIM

First find your selector. Open a message you sent, view its full headers and find the DKIM-Signature header: s= is the selector and d= is the signing domain (RFC 6376 §3.5). Google Workspace's default selector is google (Google); Microsoft 365 uses selector1 and selector2 (Microsoft). Other services and custom setups use their own names. Then look it up:

nslookup -type=TXT google._domainkey.example.com

An answer with a long p= value, usually after v=DKIM1, means the key is published. An empty p= means the key was revoked (RFC 6376 §3.6.1).

4. A real message

Send yourself a message at a Gmail address and choose More → Show original. The Authentication-Results header shows the spf=, dkim= and dmarc= results for that message. You want all three to say pass.

How to read what you find

Our report grades SPF and DMARC together, because DMARC is what decides whether forged mail gets blocked. The ratings below are what our full report shows.

SPF

"Enforcing" means the policy receivers will actually apply is quarantine or reject. p=quarantine in test mode (t=y or pct=0) counts as not enforcing, and so do two DMARC records; p=reject in test mode still counts, because receivers then apply quarantine (see the DMARC table below). One exception for ~all: if a pct= tag limits p=quarantine to part of your mail, the Low note stays.

DMARC

One cause, one High finding. When SPF is missing, broken, or ends ?all or with no all, and DMARC isn't enforcing, nothing asks receivers to block forgeries of your domain. Our report shows that as a single High finding, "Criminals can send email that looks like it's from you", with both fixes. The SPF and DMARC problems behind it are listed under it as Low findings, each with its own evidence and fix, instead of as two more Highs. SPF ending +all is that same High finding whatever your DMARC policy says. The report also lists DKIM as a note for you to confirm, because the selector name can't be reliably found from outside.

How to close each gap

• No SPF: publish one that names your email provider. There are ready-made examples in step 1 of our DMARC guide.
• Two SPF records, or a broken redirect=: merge them into one record and delete the extra, or point redirect= at a name that has exactly one SPF record.
• +all, ?all or no all: once every legitimate sender is listed, end the record in ~all or -all. Either works once DMARC is enforcing; the DMARC guide explains the trade-off.
• No DMARC, or p=none: follow how to set up DMARC, step by step to reach p=quarantine and then p=reject without blocking your own mail (Google).
• DKIM off: turn on DKIM signing in your email admin console and at every service that sends as you.
• Domains that never send email, such as old names and parked domains: publish these two records so receivers reject mail that claims to come from them (Microsoft: SPF, DMARC).

v=spf1 -all

v=DMARC1; p=reject;

The FTC's advice to small businesses is simple: if your business email uses your company's domain, make sure your email provider has all three tools, SPF, DKIM and DMARC (FTC). DMARC blocks spoofing only once it's enforced, and only at receiving servers that check it.

Warn customers and vendors

If a fake invoice or payment request went out in your name, tell the people most likely to act on it: customers with open invoices, and suppliers you pay. Keep it short, and make one rule clear: you never change payment details by email alone. The FBI's Internet Crime Complaint Center advises confirming changes to account details through a separate channel (IC3), and the FTC says to call a number you know is correct, not one in the email (FTC).

Subject: Please ignore emails asking you to change how you pay us

We've learned that someone is sending emails that pretend to come from [Your Business]. Some ask for payment or give new bank details.

We have not changed our payment details, and we never change them by email alone. If you get an email asking you to pay us differently, don't reply and don't pay. Call us to check, using the number on our website or a past invoice, not a number in the email.

If you've already paid in response to one of these emails, contact your bank right away, then let us know.

Thank you,
[Name], [Your Business]

Report it

• If money was sent, call your bank at once and ask for a recall or reversal of the payment (IC3).
• File a complaint with the FBI's Internet Crime Complaint Center at ic3.gov. IC3 asks people to file even when they're unsure whether it counts.
• If an account was hacked, tell your email provider or IT support too.

What DMARC can't stop

Three different tricks get called spoofing, and they need different defenses:

• Exact-domain spoofing: the From address is billing@example.com, your real domain. SPF, DKIM and an enforced DMARC policy are built to stop this.
• Lookalike domains: examp1e.com or example-billing.com. DMARC doesn't cover these (RFC 9989 §2.2).
• Display-name tricks: "Example Billing" in front of a free webmail address. Also outside DMARC's scope (same section).

For the last two, the defense is process: when an email asks for money, new payment details or sensitive information, call the sender on a number you know is correct (FTC), and look closely at the sender's address, especially on a phone (IC3).

What our free scan checks: it reads your domain's public SPF and DMARC records and checks them for the problems in the tables above; the $7 report shows each one's rating and the exact fix. It's passive: the same DNS lookups anyone can make. It can't see inside your mailboxes, so it won't spot a hacked account. Check your domain free.