Anyone can send email as your business · CyberZombi3

2026-08-18

Business email compromise does not usually start with a compromise. It starts with a domain that never published a DMARC record, which means anyone on the internet can send mail that appears to come from the finance director, and receiving servers have no instruction to stop it. No credentials, no malware, nothing on the target's network touched.

I have built a free check for it. Put in a domain, get a graded answer in about three seconds: Email Spoof Check.

> What the three records do

SPF lists which servers may send mail for your domain. On its own it does not stop anyone forging the address a human actually sees.

DKIM cryptographically signs messages so a receiver can tell they were not altered in transit.

DMARC is the one that matters. It ties the other two to the visible From: address and tells receivers what to do when a message fails: nothing, quarantine it, or reject it outright. Without an enforcing DMARC policy the other two records are largely decorative.

> The check reads public DNS and nothing else

This is deliberate and it is the only reason the tool can exist as a link rather than an engagement. Every lookup is a public DNS record, the same data any receiving mail server reads to decide whether to trust a message. Nothing is scanned, nothing is probed, and no authorisation is required. Active testing is a completely different tier with a completely different legal profile, and blurring the two is how people get themselves into trouble.

> The honest limitation

DKIM cannot be checked reliably from outside and the tool says so. Keys live at a selector name chosen by whoever set up the mail, and that name is not published anywhere in DNS, so it cannot be enumerated. The check works backwards from your MX records to guess the selectors your provider normally uses. A miss means we did not guess your selector, not that DKIM is missing, so the result is reported as informational and never counts against the grade. Telling someone they have no DKIM when they do would be a false accusation, and a tool that does that is worse than no tool.

SPF and DMARC carry no such caveat. Those live at fixed, well known names, so an absent record genuinely means absent. Which, for a surprising number of small businesses, it is.