Can Someone Send Emails Pretending to Be Your Business?

Yes: anyone can put your business’s email address on an email they send. Whether that fake email reaches your customers depends on one record most small businesses have never heard of, called DMARC. Without it, nothing tells Gmail, Outlook and other email systems to block emails that pretend to be you.

Email was designed in the 1980s, when everyone on it knew each other. The “From” address on an email is just text the sender types in, like the return address on an envelope. Nothing in email itself checks it.

So a criminal can send an email from their own server that shows accounts@yourbusiness.co.uk as the sender. Your customer sees your name and your address. The email might be a fake invoice with “our new bank details”, or a request to pay urgently.

Your own mailbox is never touched, so you see nothing: no strange sent emails and no unusual sign-ins. Often the first you hear of it is a customer asking about an invoice you never sent.

AI has made these emails easier to write and harder to spot. They no longer have the spelling mistakes and odd phrasing people used to rely on. The defence below hasn’t changed, but it matters more than it used to.

Three records in your domain’s settings (its DNS) work together:

• SPF lists the services allowed to send email for your domain.
• DKIM adds a digital signature to your genuine emails, which the receiving system checks.
• DMARC joins the two to the address your customers actually see, and tells receiving systems what to do with an email that claims to be from you but fails the checks.

The important part is DMARC’s instruction, the “policy”:

Swipe sideways to see the whole table.

SPF on its own isn’t enough. It checks a hidden sender address that your customers never see, so a fake can pass SPF and still show your address. My guide to SPF, DKIM and DMARC explains each record in more detail.

You can look up your own DMARC record in a minute:

1. Go to a free DNS lookup site, such as Google’s at dns.google.
2. Type _dmarc.yourbusiness.co.uk (with your own domain after _dmarc.) and choose the record type TXT.
3. Look at what comes back:
   • Nothing found: no DMARC record. Anyone can send email that looks like yours, and nothing tells other systems to block it.
   • A record containing p=none: you’re watching, but not blocking yet.
   • A record containing p=quarantine or p=reject: fakes are being filtered or refused.

My guide on how to check your email is set up correctly covers SPF and DKIM as well.

Don’t jump straight to p=reject. If one of your genuine sending services (your website’s contact form, your accounts software, a newsletter tool) isn’t covered by SPF or DKIM, a strict policy will block your real emails too.

1. Make sure SPF and DKIM are right for every service that sends email as your domain.
2. Add DMARC at p=none with a reporting address, so you receive daily reports of who is sending as you.
3. Read the reports for two to four weeks. Check that every genuine service passes. My guide to what DMARC reports tell you shows how to read them.
4. Move to p=quarantine, then, once nothing genuine is caught, to p=reject.

DMARC protects your exact domain. It can’t stop:

• Lookalike domains, such as yourbusiness-ltd.co.uk or yourbusness.co.uk. Criminals register these to look like you. Watch for them in emails from your “colleagues” and suppliers.
• A mailbox that has actually been broken into. Then the emails really do come from you and pass every check. Two-step sign-in on every mailbox is the defence: see my guide to email security for small businesses, and what to do if your email has been hacked.

So keep one simple rule in your business, whatever your settings: any change to bank details is confirmed by phone, on a number you already have, never one given in the email.

• Warn your customers and suppliers that fake emails are going round, and remind them of your phone-to-check rule.
• Check your own mailbox isn’t the source: look at your Sent folder, recent sign-ins and any forwarding rules you didn’t set up.
• Set up DMARC as above. Even at p=none, the reports will show you where the fakes are coming from.
• If money has been lost, report it to Action Fraud (actionfraud.police.uk) and the bank straight away.

• What is SPF, DKIM and DMARC?
• What DMARC reports tell you
• Email security for small businesses

Need help fixing this?

I provide:

• Free initial assessment
• Clear explanation of the issue
• Fixed-price solutions
• UK-based support

I can check whether your domain can be faked, set up SPF, DKIM and DMARC, and take you safely all the way to full protection.