Without any special tools and without breaking into anything, a stranger can send an email that appears to come from your business. Your domain in the From line. A short, reasonable request: pay this invoice, or update the account we send payments to. Your client opens it, because why wouldn't they.

In this episode, Jason Russell walks through why email was built this way, and the three DNS records that make spoofing much harder to pull off: SPF, the list of servers allowed to send for your domain; DKIM, the tamper-proof signature on every message; and DMARC, the rule that ties them together and tells receiving servers what to do when something fails.

Then the part most businesses miss. DMARC has three policy settings, and the most common mistake is stopping at the first one. A domain sitting at p=none gets you reports about being spoofed — not protection from it. CISA treats that setting as a temporary step toward reject, not a finish line.

The episode closes with what these records genuinely cannot stop: lookalike domains and display-name spoofing, both of which show up constantly in wire fraud aimed at law firms and title companies. Records handle the easy version of the attack. A verification habit handles the rest.

You'll finish this one knowing exactly what to ask your IT provider, and how to tell whether the answer you get is a real answer.

In this episode

• (0:00) Why someone can send mail in your name right now
• (1:40) The envelope analogy: why email never verified senders
• (3:30) SPF — the list of who's allowed to send
• (5:00) DKIM — the signature that proves nothing was altered
• (6:15) DMARC — the rule that ties it together
• (8:15) The p=none trap, and why it isn't protection
• (10:00) What these records don't stop: lookalike domains and display-name spoofing
• (12:00) Why this matters even if you barely send email
• (13:30) The three-step rollout, in order
• (15:00) What to do this week

Key takeaways

• Email doesn't verify senders on its own. Your domain is forgeable until you configure it otherwise.
• SPF lists authorized servers, DKIM signs messages, DMARC decides what happens on failure and reports who's using your domain.
• p=none is monitoring, not protection. Real protection starts at quarantine and lives at reject.
• Free checkers confirm records exist — not that they're configured correctly, which is where most problems hide.
• Neither DMARC nor anything else catches lookalike domains or display-name spoofing. Verify payment changes by phone, using a number you already have.

Resources

• Companion article: How to Stop Someone From Sending Email in Your Company's Name — https://harmony-msp.com/how-to-stop-someone-from-sending-email-in-your-companys-name/
• CISA Binding Operational Directive 18-01, Enhance Email and Web Security — https://www.cisa.gov/binding-operational-directive-18-01
• Google Email Sender Guidelines FAQ — https://support.google.com/mail/answer/14229414
• Microsoft, "Strengthening the Email Ecosystem: Outlook's New Requirements for High-Volume Senders" — https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%e2%80%99s-new-requirements-for-high%e2%80%90volume-senders/4399730
• Law firm IT and security — https://harmony-msp.com/industries-we-serve/law-firm/
• Medical and dental practice IT and security — https://harmony-msp.com/industries-we-serve/medical-dental-practices/