Can Someone Send Email From My Business's Real Address?

Can someone send email from my business's real address?

They can try, and whether it works depends on a few settings on your domain that most business owners have never heard of.

When somebody pretended to be me in September 2026, they used a Gmail account with a name close to ours. They didn't try to fake our actual address, and that's no accident. Faking a real address is a lot harder, IF the domain is set up to stop it.

How does an email server know what's real?

When an email arrives, the receiving server can check a few records the domain owner has published. There are three of them, and honestly the names are worse than what they do.

SPF is a list of the servers that are allowed to send email for your domain. If mail claiming to be from you comes from somewhere else, it doesn't match.

DKIM is a signature your mail server stamps on every message it sends, so the receiving end can tell the message really came from you and wasn't changed along the way.

DMARC is the instruction. It tells receiving servers what to do when a message claiming to be from you fails those checks, whether that's letting it through anyway, sending it to spam, or refusing it outright.

Without DMARC, the receiving server has to make its own guess, and plenty of fakes get delivered.

What did we change after the scam?

The next week we went through our own setup. Aggieland's DMARC record now tells receiving servers to send anything that fails the checks to spam, and we went through the client domains where we handle email and fixed the ones that were missing a piece.

To be clear, none of that would have stopped the Gmail fake. Anybody can open a Gmail account with any name they want. What it does is make the next step up, faking our real address, much harder to pull off.

How do I know if my domain is set up?

Ask whoever handles your email. The question is just "do we have SPF, DKIM and DMARC set up, and what's our DMARC policy?"

If you'd rather look yourself, search for a free "DMARC checker," type in your domain, and it'll show you whether a record exists and what it says. A policy of "none" means it's only watching and reporting. "Quarantine" sends failures to spam, and "reject" refuses them.

Frequently asked questions

Will DMARC stop all fake emails?

No. It protects your real address. It does nothing about a scammer who opens a Gmail account with your name in it, which is why calling a number you already have still matters.

Can setting this up break my own email?

It can if it's done in the wrong order. If a service that legitimately sends email for you, like your invoicing or newsletter tool, isn't listed in your SPF record, a strict policy can send your own real email to spam. That's why it's usually tightened a step at a time.

Does a small business really need this?

Yes, and more every year. Since 2024, Gmail and Yahoo have required senders to authenticate their email, with the strictest rules for anybody sending in bulk.

Can you check my domain?

If we handle your email, ask us and we'll look at your records with you. If your email is somewhere else, we're still happy to take a look.

Let's talk

Not sure how your email is set up? Call me at 979-217-1544.

Tom Bruch has built websites since 1998 and is the owner of Aggieland Website Design.