Someone is sending emails in your name: SPF, DKIM and DMARC in plain language

A customer calls: 'I received an invoice from you with a different account number, is that right?' You sent nothing. Yet your name and your email address appear as the sender. This happens to SMEs every week, and the annoying part is that you usually only hear about it from the recipient. In this article we explain what is going on, why three technical settings (SPF, DKIM and DMARC) largely prevent it, and how to check whether yours are set up correctly. No technical background required.

Spoofing or hacked? Two different problems

First the distinction, because the approach differs.

• Spoofing: someone forges the sender address. Just as you can write any name as the sender on a letter, an attacker can send an email with your address on it without ever having been inside your mailbox. Your systems are not hacked. The receiving mail server has to stop this, and it can only do so if you have told that server what does and does not come from you.
• Hacked mailbox: someone has your password and actually logs into your account. Then the emails really leave from your mailbox, often after weeks of quietly reading along. That is more serious. In that case, read recognising phishing and what to do if someone clicked right away.

How to tell the difference: look in your 'Sent items' folder and in the sign-in history of your account. If you see nothing odd there, it is probably spoofing. If you see unknown sign-ins or rules forwarding mail, it is a hack and you change your password immediately.

SPF, DKIM and DMARC in plain language

These three are settings on your domain name, the part after the @. They work together, and each does one thing.

SPF is the list of who is allowed to send mail on your behalf. You tell the world: 'emails from mycompany.be come from Microsoft 365, from our newsletter tool and from our accounting package. Everything else is not ours.' A receiving server checks that list.

DKIM is the signature on the letter. Every email you send gets a digital signature that only your mail system can apply. The recipient checks whether the signature is valid and whether nothing was changed in the email along the way.

DMARC is the instruction for the recipient: what should they do if SPF or DKIM does not check out? Nothing (none), put it in spam (quarantine) or refuse it (reject). DMARC also says where the reports should go, so you can see who is trying to send mail on your behalf.

Why this also affects your own deliverability

This is not only about attackers. The big mail providers set increasingly strict requirements for whoever sends them mail. Without correct SPF, DKIM and DMARC, your own quotes and invoices end up in spam more often, or simply do not arrive. You do not notice, because nobody tells you. You only notice that customers 'did not receive anything'. If you send newsletters or emails to many recipients at once, this is a condition today, no longer an option.

How to check whether yours is set up correctly

You do not have to dive into this yourself. Two options.

• There are free online checks where you enter your domain name and immediately see whether SPF, DKIM and DMARC are present and correct. Search for 'DMARC check' and you will find several.
• Ask your IT partner. Checking this takes ten minutes. If your partner does not know what you mean, that is an answer in itself.

What you want to see: SPF present without errors, DKIM active for your mail system, and DMARC on at least quarantine with a reporting address that someone actually looks at.

Common mistakes

• A tool that sends mail on your behalf and is not in SPF. The newsletter tool, the accounting package that sends invoices, the webshop, the scheduling software. Each of them has to be in the list, otherwise precisely that mail gets refused.
• Leaving DMARC on 'none' for years on end. The recipient then checks, but does nothing with the result. You are just as vulnerable as without DMARC.
• Reports going to a mailbox nobody looks at.
• Forgetting multiple domains. The old domain you still own, the .com next to the .be, the domain of the previous trade name. Everything you own and do not send mail from, you explicitly set to 'nobody may send mail with this'.

Step-by-step plan

1. Take stock of who sends mail on your behalf. Make a list of every service that sends email with your address. Check with your accountant and whoever does the marketing, they often know more about it than you do.
2. Set SPF and DKIM correctly for each of those services. This is an hour of work for your IT partner, provided the list is complete.
3. Set DMARC to monitoring (none) with a reporting address. For a few weeks you see everyone sending mail on your behalf, including the services you had forgotten.
4. After a few weeks, tighten to quarantine and then to reject. From then on, a forged email with your address is refused by every recipient that respects DMARC.
5. Put the reporting address in the calendar: review it once a quarter.

If fake invoices with your name are already being sent today, also read invoice fraud: preventing a fake bank account. Spoofing is often the technique behind the fake invoice.