Someone is sending email in my company's name
SMTP has no built-in authorisation for the From header. Any host can open a connection and write From: you@yourdomain.com; nothing in the protocol stops it. What decides whether such a message is delivered is the policy you publish and the receiver's willingness to enforce it.
Why it works at all
RFC 5321 (the envelope) and RFC 5322 (the headers) are separate layers. SPF authorises the sending IP for the envelope domain; nothing in it constrains the header the recipient actually sees. That gap is what DMARC (RFC 7489) closes: it requires that an SPF or DKIM pass be aligned with the RFC5322.From domain, and tells receivers what to do when neither is.
Without a _dmarc record, or with p=none, there is no instruction to refuse anything. The receiver notes the failure and delivers the message.
What actually stops it
A DMARC policy at p=quarantine or p=reject, on a domain whose legitimate mail already aligns. The order matters: publish the policy before your own senders align and you block your own invoices.
- Publish
v=DMARC1; p=none; rua=mailto:…and collect aggregate reports for two to four weeks. - Use the reports to find every source sending as you, and get SPF or DKIM aligned for each legitimate one.
- Move to
p=quarantine, thenp=reject, once aligned volume is at or above 95% and no unexplained source remains.
The subdomain most people forget
Without an sp= tag your policy also covers every subdomain, including names you never use — invoices.yourdomain.com is as forgeable as the apex until a policy applies to it. If you do set sp=, you are overriding that inheritance, so set it to something at least as strict as p=.
What you can see today
The scan at the bottom of this page reads your _dmarc record, breaks it down tag by tag, and shows what a receiver derives from it — including the defaults for the tags you did not set, because those are what actually apply.
Frequently asked questions
The message came from an address that does not exist here.
That is the normal case: the sender invents a local part on your domain. DMARC operates per domain, not per mailbox, so a policy covers addresses that were never created.
Can I find out who sent it?
You get the source IP, the volume and the authentication results per source from the DMARC aggregate reports, which is enough to tell a forger from your own misconfigured service. It is not attribution: the reports carry no message content.