Email spoofing help
Someone is sending emails from my domain. What's going on, and how do I stop it?
Bounce-backs for messages you never wrote, or a customer asking "did you send this?" is scary. Take a breath: in most cases, nobody is inside your email.
The short answer
Usually nobody is inside your email. Scammers are forging your address in the "From" line, which is easy when your domain is missing SPF, DKIM and a strict DMARC policy. Check your Sent folder first: if the messages aren't there, it's spoofing, and fixing those three DNS records is what stops it. If they are there, or you see strange sign-ins or inbox rules, treat it as a hacked account and get a specialist.
Check your domain's email protection free in 10 seconds
Three things that look the same from the outside
From your customer's inbox, these three problems can look identical. They have very different fixes.
| Forged address (spoofing) | Hacked mailbox | Lookalike domain or name | |
|---|---|---|---|
| What's happening | A scammer's server puts your address in the From line | Someone has your password or a session and sends from your real account | A domain one letter off, or just your name as the display name on a free account |
| Signs | Bounce-backs you didn't cause; nothing in your Sent folder | Odd messages in Sent, new inbox rules or forwarding, unfamiliar sign-ins | The address looks right at a glance but isn't your domain |
| Does DMARC fix it? | Yes, at receivers that enforce it | No. Mail from your real account passes the checks | No. It's not your domain |
| What helps | SPF, DKIM and DMARC records | A specialist, your email provider's support, password reset and two-step verification | Warning customers, spam filtering, reporting the domain |
Forged or hacked? A 2-minute check
Step 1: Look in your Sent folder
Search Sent for the subject or recipient of one of the strange messages. If it isn't there, that points to forgery: the message never left your account.
Step 2: Review recent sign-ins and inbox rules
On Google Workspace or Gmail, run Google's Security Checkup and look at recent devices and activity. On Microsoft 365, ask whoever manages it to check the sign-in logs. In either one, look for inbox rules or forwarding you didn't create. Hidden forwarding rules are a common sign of a hacked mailbox.
Step 3: Ask a recipient to forward one "as an attachment"
Forwarding as an attachment keeps the original technical headers. In them, look for a line called Authentication-Results. If it says dmarc=fail (or SPF and DKIM both fail for your domain), the message almost certainly didn't come from your systems.
If it looks hacked: stop and get help
Change the password, turn on two-step verification, and contact your email provider's support or an IT or incident-response specialist right away. They can sign out other sessions, remove bad rules and check what was accessed.
This isn't something a DNS fix solves. SiteSafeCheck refers hacked accounts to specialists; it doesn't handle account recovery, breach cleanup or malware.
Why scammers can use your address
Email was designed in a more trusting era. The From line is just text the sender types, a bit like a return address on an envelope. Nothing in the original design checks it. Three DNS records (public settings for your domain) were added later to fix that:
- SPF (Sender Policy Framework) is a guest list: the servers allowed to send email as your domain.
- DKIM (DomainKeys Identified Mail) is a tamper seal: a digital signature that proves a message really came from your domain and wasn't changed on the way.
- DMARC (Domain-based Message Authentication, Reporting and Conformance) is the instructions: it tells receiving servers what to do with mail that fails those checks (nothing, spam folder, or reject) and sends you reports about who is sending as you. More in What is DMARC?
Without a strict DMARC policy, many receivers have to guess, and forged mail can land in your customers' inboxes. The same records also help your real email avoid the spam folder.
How to stop the forgeries (if it's spoofing)
1. List everything that sends email as you
Your email host (Google Workspace, Microsoft 365 and so on), plus anything that sends on your behalf: invoicing, booking or scheduling tools, your website's contact form, and your newsletter service. Missing one is the most common way a rollout blocks real mail.
2. SPF: one record that lists every sender
Your domain should have exactly one SPF record. It includes each sender from your list and ends with a hard fail, which tells receivers everything else isn't allowed. Two SPF records, or one with too many lookups, can quietly break it.
3. DKIM: turn it on at each sender
Each service that sends as you has a DKIM setting. It gives you a key to publish in your DNS, and then it signs your mail.
4. DMARC: tighten in stages
New to DMARC? Here's a plain-English guide to what the three settings do.
Start with a monitor-only policy (p=none) that changes nothing and sends you reports. Once the reports show your real mail passing, move to quarantine (failures go to spam), then reject (failures are refused). Don't jump straight to reject: it can block your own invoices or form emails if a sender was missed.
If you're on Google Workspace, Microsoft 365 or GoDaddy
Google Workspace and Microsoft 365 both have DKIM switches in their admin consoles, and both publish the SPF value to include. If you bought Microsoft 365 through GoDaddy, the DNS usually lives at GoDaddy too. Some IT admins on Reddit report that these bundles didn't come with a strict DMARC policy, so it's worth checking yours rather than assuming.
What DMARC won't fix
- A hacked account. Mail sent from your real mailbox passes every check. That needs a specialist (see above).
- Lookalike domains and fake display names. They aren't your domain, so your records don't apply. Warn customers and report them.
- Every receiver, instantly. Not every mail server enforces DMARC, and bounce-backs from forgeries already in flight can keep arriving for a while. They should slow down once your policy is strict.
Frequently asked questions
Does this mean my email was hacked?
Usually not. Most of the time a scammer is only forging your address in the From line. Check your Sent folder: if the messages aren't there and you don't see unfamiliar sign-ins or inbox rules, it's spoofing. If they are there, treat it as a hacked account and get a specialist.
Why didn't changing my password stop it?
Because the forgers never had your password. They type your address into the From line on their own mail server. What stops it is publishing SPF, DKIM and DMARC records for your domain, which tell receiving servers how to spot and reject the fakes.
Can I stop people from using my email address completely?
For your exact domain, a DMARC policy of reject tells receiving servers that honor it to refuse mail that fails the checks. It can't stop lookalike domains (one letter off) or a fake display name on a free email account, and not every receiver enforces DMARC.
Will setting up DMARC break my email?
Not if you roll it out in stages. Start with a monitor-only policy that changes nothing and sends you reports, add every service that sends as you, and tighten only once the reports show your real mail passing. Jumping straight to the strictest setting can block your own invoices or website form emails.
How long does the fix take?
The records themselves publish quickly. The safe part is the rollout: you watch the reports for a while (often a couple of weeks, or one full billing cycle so invoices are covered) before tightening the policy. How long depends on how many services send email as you.
Should I tell my customers?
Yes, briefly. Let them know scammers have been forging your address, that you never ask for payment or bank changes by email, and that they should call you on a number they already have to confirm any unusual request.
What are these bounce-backs for emails I never sent?
They're usually called backscatter. A forged message was sent with your address on it, the recipient's server couldn't deliver it, and the "undeliverable" notice came back to you. They aren't proof your account is hacked. Mark them as spam, and they should slow down once DMARC is enforced.
Is a Gmail address protected the same way?
No. If your address ends in gmail.com you can't set DNS records for it; Google manages that. Follow Gmail's own guidance for spoofed addresses. This page is for businesses that use their own domain, like you@yourbusiness.com.
Want the bigger picture? The free SiteSafeCheck also looks at HTTPS, security headers and other common gaps, and the About page explains exactly what it checks and what it can't see.