An email I didn’t send
Last week, several of our clients got an email from me. It had our logo, my name and title, and a warning that their website had missed a required WordPress update and had to be fixed by a deadline. While they were at it, it suggested this would be a good time for a full SEO setup.
The problem is, I didn’t send it.
Several clients noticed it came from a Gmail address with “gruffy” misspelled, and asked us before replying. It was a scam, and nobody lost anything, but this stuff is so annoying to deal with.
Unfortunately, emails like this are becoming more common because they’re easier to pull off than ever. The same popular AI tools that everyone’s using also let scammers write a convincing email in someone else’s voice in seconds and send it to as many inboxes as they want. A misspelled address was the only giveaway on ours. The next one might not have anything obvious at all.
This issue sent me straight to our own email DNS records, and after a deep dive, I came away with some helpful tips to share, which is what the rest of this post is about!
What we could and couldn’t have done about it
Email spoofing is sending a message that looks like it came from someone it didn’t. There’s nothing we could have set up that would have stopped that email. The sender used a free Gmail account and information anyone can find on our website or with a quick Google search. As far as Gmail could tell, it was a normal message from a normal Gmail user.
That’s email impersonation. Sometimes it’s display-name spoofing like ours: a real name on top of an unrelated address. Sometimes it’s a lookalike domain, or a domain 1 letter off from the real thing. All of which are hard to detect if you don’t know the real domain. Unfortunately, your own settings can’t block these either, because the sender never touches your domain.
“Domain spoofing” is different. That’s someone forging your actual address, so the email looks like it came from you@yourcompany.com. That’s how most fake invoice scams work. It’s the more dangerous of the two, because it passes the glance test that caught ours. Fortunately, domain spoofing can be blocked.
How to tell if an email is spoofed
You can check for email spoofing in 2 steps:
First, read the actual address, not the name. Hover over or tap the sender. A business writing from a free Gmail, Outlook, or Yahoo account deserves a second look, and so does a company name that’s off by a letter or alerts your spidey-senses in other ways. Then read the email like a skeptic. A surprise deadline or a sales pitch is the pattern nearly all of these follow.
Second, look at what mail servers see. In Gmail, open the message, click the 3 dots, and choose Show original. In Outlook, look for the message headers under message details. Near the top, you’ll see SPF, DKIM, and DMARC, each marked pass or fail. If an email claims to come from a company’s own domain and DMARC fails, it was forged.
How to stop email spoofing on your own domain
3 records in your domain’s DNS do the heavy lifting and can save you a lot of headaches. If you’re thinking about email security for a small business and only have time for one thing, make it this. Gmail and Yahoo already require these records from anyone sending email in bulk, and the rest of us are better off having them, too.
Picture an office building with a front desk. SPF is the list of who’s allowed in, meaning every service that sends email as your company. DKIM is a seal on each letter that proves it came from your email provider and wasn’t changed along the way. DMARC tells the front desk what to do with anyone who fails. DMARC is 1 line of text, and the setting that matters is the policy. It looks something like this:
v=DMARC1; p=reject; sp=reject; rua=mailto:reports@yourdomain.com
At p=none, mail that fails still gets delivered. At p=quarantine, mail goes to spam. At p=reject, mail is refused and never arrives. Reject is the goal. The sp setting does the same for subdomains, and rua is where reports get sent so you can see who’s sending as you.
If you’re starting from nothing, publish SPF and turn on DKIM for every service that sends as you (e.g., Mailchimp, HubSpot, Salesforce), then publish DMARC at p=none with reporting on. Google’s own DMARC setup guide walks through it if you’re on Google Workspace. Give it a few weeks, fix anything the reports show failing, and move to quarantine and then reject.
What we changed on our own domain
Our DMARC was already set to quarantine, so forged gruffygoat.com mail was going to spam. We turned on reporting through Cloudflare’s free DMARC Management, set subdomains to reject, and upgraded our Google Workspace DKIM key from 1024-bit to the new 2048-bit Google recommends. Once the reports confirm everything legitimate is passing in a week or so, we’ll move to reject.
If you’re upgrading Google Workspace DKIM yourself, give the new key a new selector name instead of reusing “google.” The old key keeps working until Google switches over, so your mail never fails in between.
While none of this would have stopped last week’s email, it will stop the worst version of it.
How to check your own records
This may sound like a lot of technical info, but honestly, checking takes only about 5 to 10 minutes. Google’s free Admin Toolbox and MXToolbox both look up SPF, DKIM, and DMARC for any domain. Type in yours. A missing DMARC record, p=none, or sp=none are the ones to look for and act on.
Then send an email from your work address to a personal Gmail account and open “Show original”. 3 passes mean your mail is authenticated correctly. If what comes back reads like a foreign language, send it to us, and we’ll help you translate it.
If someone is impersonating you
When someone is spoofing your email from an address that isn’t yours, your DNS records won’t help. Report the account instead. For a Gmail address, use Google’s abuse report form. If it landed in your Gmail inbox, you can also open it, click the 3 dots, and choose “Report phishing”. Then give your clients a heads-up like we just did, so they know what your real email looks like, and don’t reply to the scammer, or worse, follow their instructions.
Common questions
Can email spoofing be stopped?
You can stop forgery of your actual domain almost entirely. A DMARC policy of reject, backed by SPF and DKIM, tells Gmail, Outlook, and nearly every other provider to refuse mail falsely claiming to be from you. You can’t block impersonation from a different address with anything you publish. Reporting the account and warning your clients is the defense there.
Do I need DMARC?
If you send email from your own domain, yes. It’s free, it’s 1 DNS record, and Gmail and Yahoo already expect it from anyone sending in bulk. Even a p=none record with reporting turned on shows you who’s sending as you.
Should I be worried if my email is spoofed?
It’s worth acting on, though it usually doesn’t mean you’ve been hacked, so don’t freak out. Check your DMARC policy and let your clients know. If messages you didn’t write show up in your Sent folder, that’s a compromised account, so change your password and turn on two-step verification immediately.
How can I tell if my email has been spoofed?
Usually someone tells you, like our clients did, which is always the worst way to find out. Bounce notices for messages you never sent are another sign. DMARC reports show any server trying to send as your domain, which is another reason to turn reporting on before you need it.
Why did I get an email from my own email address?
Someone forged your address, and your domain isn’t telling mail servers to refuse it. These are usually scary-sounding emails demanding payment. Moving your DMARC policy to quarantine or reject stops most of them.
What’s the difference between DMARC quarantine and reject?
Quarantine sends failing mail to spam, where it can still be opened. Reject refuses it, so it never arrives. Quarantine is a sensible place to sit while you confirm your own mail passes. Reject is where you want to end up.
Let us check your domain
Most businesses we talk to have never even heard of these acronyms, let alone checked their DNS records to see if they’re configured correctly. None of this is new, but these issues are worse than ever, thanks to AI making a spammer’s life a lot easier.
If none of this makes any sense, don’t sweat it! We care about these kinds of annoying, nitty-gritty, in-the-weeds issues. It’s the part of running a website most people never see, and it’s a big part of what we do through our Partnership Plan. Send us your domain, and we’ll look up your SPF, DKIM, and DMARC records and tell you in plain English what we’d change, if anything. No charge.
If you’re already a GruffyGoat client, this is part of your ongoing website support. Reach out to our support team, and we’ll get you squared away. It’s also one of the checks in a website security audit, if you’d like the rest of your setup looked at, too.
And if an email ever shows up with my name on it and news from a WordPress conference meeting, ask us before you reply. Spoiler alert: I’m not really a WordPress conference guy. #nerds 😉
