Skip to content
Ask Gancho

Can someone send email pretending to be my business?

Yes, if your domain has no DMARC policy telling inboxes to reject fakes. Two DNS records fix it. Here is exactly what I added to this site's domain.

Answer 12 min read

This domain doesn't send any email. That's exactly why it needed locking down. A domain with no email records is an open name: anyone can put it in the From line, and nothing tells the receiving inbox to bin it.

So anyone could send mail as hello@askgancho.com. Some inboxes would drop it in spam on their own judgement. None of them had an instruction from me to refuse it.

The two records I added

SPF, at the root of the domain:

v=spf1 -all

SPF lists the servers allowed to send email for a domain. -all with nothing in front of it means no server is allowed. Any mail claiming to come from askgancho.com fails.

DMARC, at _dmarc.askgancho.com:

v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s

DMARC tells the receiving inbox what to do when a message fails those checks.

  • p=reject means refuse it. Not the spam folder, refused.
  • sp=reject does the same for every subdomain, so nobody can use billing.askgancho.com instead.
  • adkim=s and aspf=s mean strict matching. The domain in the From line has to match exactly.

Both records showed up in public DNS within minutes. The whole job took about ten minutes in the Vercel dashboard.

If your business does send email

Don't copy these two records. -all and p=reject on a domain you send from will block your own quotes and invoices.

Do this instead:

  1. List everything that sends email as you: your mailbox (Google Workspace, Microsoft 365), your booking system, your invoicing tool, your newsletter.
  2. Add each one to your SPF record. Every provider publishes the exact line to use.
  3. Turn on DKIM signing in each of those tools.
  4. Publish DMARC with p=none and a reporting address, then read the reports for two to four weeks.
  5. When your real mail passes, move to p=quarantine, then to p=reject.

The common mistake is stopping at step 4. p=none looks set up, and it still lets the fakes through.

Check your own domain

The UK's National Cyber Security Centre runs a free email security check. Type in your domain and it tells you whether SPF and DMARC are there and what they're set to. If DMARC is missing or set to none, someone can send email as you today.

All answers