Someone is sending emails from my domain

Open one of the fake emails with its full headers showing and find the line that starts Authentication-Results:. Somewhere in it you’ll see dmarc=fail, and close by, header.from= followed by a domain. Read that domain character by character.

If it’s your domain spelled exactly right, a stranger’s server is forging your name and you can shut it off in DNS this afternoon. If it’s close to your domain and not quite it, someone registered a lookalike, your DNS isn’t consulted at all, and the job is a registrar takedown plus a round of phone calls. The two jobs share no steps, so the reading comes before anything else.

Get the headers before you touch anything

You need one complete sample of the fake with the raw headers intact. Ask a recipient to forward it to you as an attachment. In Gmail that’s “Show original” and then download; in Outlook it’s “View message source”. A screenshot of the From line isn’t evidence, because the From line is the part the forger typed.

Don’t reply to the fake, don’t click anything in it, and don’t send a mass “ignore emails from us” blast from the domain yet. A warning that arrives from the same domain during the attack reads exactly like the scam. Warnings come later, targeted, and by phone.

What the header.from domain tells you

The Authentication-Results: line is the receiving server’s own verdict, written before your recipient saw the message. dmarc=fail means the message claimed a domain it couldn’t prove it was entitled to. The domain it claimed sits in header.from=, and that domain has three possible readings. Each one is a different incident.

header.from=yourcompany.com, spelled exactly as you own it, sent from a server you don’t run. This is exact-domain forgery. Your systems aren’t compromised; the forger typed your domain into the From line, and email’s core protocol has no check that stops them. The fix lives in DNS and takes an afternoon.

header.from=yourcornpany.com, or yourcompany-billing.com, or yourcompany.co: close, and not yours. Somebody registered a lookalike. When mail comes from their domain, nothing you publish on your own domain is queried, so this is fixed by takedown and warnings and no record you own can help.

Your exact address, and the messages sit in your own Sent folder or arrive as replies inside real threads. That’s account compromise, and it’s a different incident from either of the others. Change the password, revoke all active sessions, turn on two-factor authentication, and check the mailbox for forwarding rules the intruder may have added, before you do anything else on this page.

One subtlety trips people up at this point, and it explains why a forged message can carry spf=pass. Receivers evaluate SPF against the Return-Path domain (the RFC5321.MailFrom, the bounce address). The From header your recipient sees plays no part in that check. A forger can pass SPF for their own domain in Return-Path while carrying yours in From, and the recipient only ever sees From.

DMARC’s alignment check is what closes that gap: it demands that the domain SPF or DKIM validated matches the one in From. Whether your domain currently asks receivers to make that check is the thing to find out next.

Exact domain: the DNS fix, in order

Forgery of your exact domain works for as long as your DNS says nothing that lets receivers reject it. The September 2026 census finds no DMARC record at all on 238,156,049 of the 316,600,902 domains carrying a grade, 75.2% of them. The door is open on most domains because nobody ever closed it, and yours is open for the same reason. Three records close it, and the order matters.

Publish one SPF record listing your real senders and ending -all. If your existing record ends +all or ?all, that’s an open door you published yourself, and it gets fixed first, before anything else in this section.

Switch on DKIM signing in your mail provider and in each newsletter and invoicing tool that sends as you. Each one usually hands you a pair of CNAME records to publish, and the signing starts once they resolve.

Publish v=DMARC1; p=none; rua=mailto:... the same day, with a mailbox you’ll read at the rua= address. Aggregate reports start arriving within a day or two and list every server sending as your domain, your real ones and the forger’s, with volumes and verdicts. This is how you watch the attack die.

Of the 41,888,985 domains sitting at p=none in the September 2026 census, 33,651,068 carry no rua= at all, 80.33% of them; they’re parked at none and collecting nothing, so they couldn’t see an attack like yours even while it ran.

Then ratchet. Once each real source (mail provider, newsletter tool, invoicing app, the website contact form) shows up in those reports passing SPF or DKIM aligned to your domain, move to p=quarantine, and once that’s clean, to p=reject. Under live forgery you compress the stages into days.

You do not skip them, because enforcing before your own senders align blocks your own invoices alongside the forger’s, and a customer who stops hearing from you is a customer who calls the fraudster’s number. The staged rollout, the pct ramp and the subdomain policy are all on the DMARC pillar.

A domain that sends no legitimate mail at all, an old brand or a parked domain, skips the ramp and locks down the same day, because there’s no legitimate mail to protect. If that describes the domain in your headers, parked domains can be spoofed too has the records to publish.

Lookalike domain: the takedown

Start by finding out who registered the lookalike. Run it through RDAP or WHOIS at lookup.icann.org, note the registrar, and check whether the domain hosts a website.

Report the lookalike to that registrar’s abuse contact with the full-header sample attached. Registrars suspend phishing domains daily, and clear evidence makes it quick. If the domain hosts a phishing site, report the site to its hosting provider, to Google Safe Browsing and to Microsoft SmartScreen as well.

Report the mails as phishing inside the receiving mailboxes, using “Report phishing” in Gmail and in Outlook. That trains the large filters against the lookalike faster than any letter to a registrar will.

If the lookalike abuses your trademark, a UDRP complaint can transfer the domain to you. It’s slower than a takedown and it’s permanent.

Then run the exact-domain record work anyway. Forgers rarely bother with a lookalike while the real domain is still open, and closing your own door costs you an afternoon and nothing else.

Warn the people who might pay

Contact the likely targets out of band: your customers, your suppliers, and whoever pays the invoices on your side. Phone them, or message them on a channel that isn’t email from the domain in question. Name the fake domain if there is one and tell them what the fake asked for.

Set one rule with each of them and keep it after the incident. Any change of bank details that appears to come from you gets verified by a call to a number they held before this week, and a number printed in the email doesn’t count. That habit is what stops money moving, on both sides of the triage, and it costs nothing.

Two limits an enforced policy won’t move

An enforced policy binds only receivers that check it. The large mailbox providers do, so exact-domain forgeries start dying at those receivers the day the policy lands; a small receiver that doesn’t check DMARC can still deliver the fake.

An enforced policy also does nothing about lookalike domains. Once forging yourcompany.com stops working, registering yourcompany-billing.com costs a few euro, and your DNS plays no part in what happens next. That’s why the phone calls and the registrar report stand on their own, whichever side of the triage you landed on.

The scam email that came from your own address

“From you, to you” extortion mail, the kind that claims to have hacked your account and proves it by sending from your own address, is the same forgery trick. The sender typed your address into the From line and your domain didn’t reject it. Check your Sent folder and your recent sign-in history; if both are clean, nobody is inside, and you treat it as exact-domain forgery: SPF ending -all, DKIM switched on, DMARC published with rua= and then ratcheted to reject.

If you’re reading this because you’re wondering whether it could happen rather than because it has, can someone spoof my domain walks the same checks at a calmer pace. Either way the DNS half is free, takes an afternoon, and stays closed once you’ve done it.

Figures as of 5 September 2026, from the September 2026 edition of the defaults.exposed census. Census numbers move every month; the current values are on the census data page.