Email in your name can be forged: the DMARC fix

A small property management company sent rent reminders and owner statements from its own domain. One month a tenant paid rent to a new bank account after an email "from the office" said the details had changed. The office never sent it. Nothing on the company's domain told Gmail or Outlook that mail claiming to be from it, but sent from somewhere else, should be refused, so the fake landed in the inbox looking exactly like the real thing. Here is what was missing, what was added, and how long it takes.

Check yours in ten seconds: go to mxtoolbox.com/dmarc.aspx and enter your domain (the part after the @ in your email address). "No DMARC record found" means nothing stops someone sending email as you. A record ending in p=none means receivers are told to deliver forged mail anyway; it is a starting point, not protection.

Record	Before	After
DMARC	none - receivers were given no instruction about mail that fails the checks	published with reports going to the office; tightened to quarantine once the reports showed every real sender passing, so forged mail goes to spam or is refused
SPF (who may send as you)	listed the email host but not the rent portal, so the portal's genuine reminders failed the check	one record naming every real sender: the email host, the rent portal and the website's contact form
DKIM (a signature on each email)	never switched on at the email host	switched on; every outgoing email now carries a signature receivers can verify
Result	Before, a forged "our bank details changed" email passed as the company. After, it fails all three checks and Gmail, Outlook and Yahoo send it to spam or refuse it. The company's real email lands better too: since 2024 Gmail and Yahoo require SPF or DKIM from every sender, and all three from anyone sending in bulk.

What was wrong

Email was designed before anyone thought about forgery: the "From" line is whatever the sender types. Three short text records at your domain company (GoDaddy, Namecheap, Cloudflare, Squarespace Domains and the like) are what let a receiver tell your real email from a fake. Most small businesses never add them because nothing breaks without them, until someone uses the gap.

Before (DNS records for the domain):
  (no _dmarc record)
  TXT  "v=spf1 include:_spf.google.com ~all"     <- the portal is missing

After:
  TXT  "v=spf1 include:_spf.google.com include:portal.example ~all"
  google._domainkey  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBg..."  (from the email host)
  _dmarc             TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com"

How it was fixed

List every service that sends as you: the email host (Google Workspace, Microsoft 365...), any portal or invoicing system, the website's contact form, a newsletter tool. Missing one is how real email ends up in spam.
One SPF record naming all of them. A domain may have only one; two records is a common mistake that breaks the check entirely.
Switch on DKIM at the email host and at each service that offers it, and paste the record each one gives you.
Publish DMARC with reports, starting at p=none so nothing real is blocked while the reports show which senders pass.
Tighten to quarantine once every real sender passes, usually after one to two weeks of reports, and re-check on mxtoolbox.

What it costs

I will send you the exact records for your domain, written for your domain company's panel, free, and you can paste them in yourself. If you would rather I add them, that is a fixed $75, paid only after mxtoolbox shows the policy in place. No password shared: most domain companies let you invite a helper (GoDaddy Delegate Access, Cloudflare members, Namecheap Share Access), and you remove the access when we are done. Nothing on your website or in your inbox has to change.

The company in this example is a composite built for this demo, not a real business; the missing records and the fix are the ones found on real small-business domains in October 2026. More before/after examples, and who I am: all demos.