How it works
SMTP, the protocol that carries mail (RFC 5321), has no built-in check of whether a sender may use the address it claims. Any server can deliver a message with From: billing@example.com, and without further checks that is exactly what the recipient sees.
Every message has two senders: the return path used in the SMTP conversation (envelope from) and the From address shown in the header. Attackers usually forge the visible one. SPF only checks the return path, DKIM checks the signature, and only DMARC requires one of them to match the visible domain.
Some variants slip past SPF, DKIM and DMARC entirely: a familiar display name in front of an unrelated address, or a look-alike domain such as examp1e.com.
Why it matters
Forged mail in a client’s name is used for invoice fraud such as CEO fraud or fake bank detail changes, for phishing, and to spread malware. Recipients trust the familiar domain, and the damage lands on business partners and the client’s reputation.
Deliverability suffers too: when complaints about forged mail pile up, mailbox providers rate the domain lower, and bounces for messages you never sent (backscatter) flood the inbox.
How to prevent it
- Set up SPF with -all, DKIM signed with your own domain, and DMARC for every client domain.
- Review DMARC reports and raise the policy to p=reject; only then do receivers refuse forgeries of the exact domain.
- Protect domains that never send mail with v=spf1 -all, DMARC p=reject and a null MX (0 .).
- Keep an eye on newly registered look-alike domains and register the obvious typo variants yourself.
- Agree as a team that payment changes requested by email are always confirmed through a second channel.
How DomainWarn detects it
DomainWarn never sees the forged messages, since they go to other people’s mailboxes, so there is no dedicated spoofing check. What it checks is the protective layer: the SPF, DKIM and DMARC checks report missing records, overly permissive SPF records (+all, ?all or no all), invalid or short DKIM keys, and a DMARC policy that only monitors. A weakened DMARC policy and a removed SPF record are critical changes.
Whether someone is actually sending in your name shows up in the DMARC reports: with DomainWarn’s report address you see every sending source with its SPF, DKIM and alignment result, and the DMARC assistant separates forgeries without any authentication from legitimate mail. Newly registered look-alike domains are reported by the look-alike domains check.
DomainWarn checks this for all your domains on a schedule and alerts you when something is missing or changes.