Anyone can send email as you

By default, the email system lets anybody claim to be anybody. Nothing stops a stranger sending a message that appears to come from your domain — to your customers, your suppliers, or your accounts department, with your name on it.

Three DNS records fix that. They are not a website change, they cost nothing, and once set they keep working.

The three records, in plain terms

• SPF is a published list of who is allowed to send email using your domain — your mail provider, your newsletter tool, your invoicing system.
• DKIM adds a cryptographic signature to each message so a receiving server can confirm it really came from you and wasn't altered on the way.
• DMARC is the one that matters most and the one almost everyone gets wrong. It tells receiving servers what to do when a message fails the first two — and it's where you'll also start getting reports about who is sending mail as you.

The mistake nearly everyone makes

We can show you this from the inside

While writing this we checked our own four sending domains. They sat at four different levels of maturity, and the progression is the article:

• One domain was at full enforcement — failing mail rejected outright, reports flowing to three collectors, alignment settings explicit. That one had earned it: it went to enforcement only after months of reports came back clean.
• A second sat one notch below, at quarantine, with the same reporting.
• A third — the domain this very website runs on — was at monitor-only with a single report address. Correctly signed, properly authenticated, and telling the world to do nothing about failures anyway.
• The fourth was the weakest: a bare monitor-only record with no reporting address at all, and no sender list published on the main domain.

Same owner, same registrar, same email provider, four different postures. That's not negligence — it's what happens when records get set up at different times for different reasons and nobody goes back. It's almost certainly true of your domains too.

How to do it without breaking your own mail

The risk in tightening DMARC is real and worth naming: if some legitimate sender you've forgotten about isn't properly listed — an old newsletter tool, a form handler, a billing system — moving straight to "reject" starts silently killing its mail.

• Start at monitor-only with a real reporting address, and actually read the reports for a few weeks. They tell you every system sending as you, including ones you'd forgotten.
• Fix whatever the reports surface — usually one or two legitimate senders missing from your list.
• Move to quarantine. Failing mail goes to spam rather than the inbox, so a mistake is recoverable.
• Once quarantine is quiet, move to reject. That's the finish line, and getting there in three steps rather than one is the whole trick.

Sources

• RFC 7489 — Domain-based Message Authentication, Reporting, and Conformance (DMARC)
• RFC 7208 — Sender Policy Framework (SPF)
• RFC 6376 — DomainKeys Identified Mail (DKIM)
• CISA — Enhance Email and Web Security guidance
• Our own four sending domains, read from live DNS, August 2026