Spoofing is a DNS fix. A hacked account is an incident. Work out which one you have first.

Two different problems with the same symptom

When a client calls to ask about an odd email “you” sent, or your inbox fills with bounce-backs for messages you never wrote, there are two very different explanations. Either someone is faking your address from outside (spoofing), or someone is inside your account and sending as you (compromise). From the recipient’s side they look the same. From your side they need completely different responses.

My firm view is that spoofing is a DNS fix, and compromise is an incident. If you treat a compromise like spoofing, you tighten your email records while the attacker carries on reading your mail and replying to your clients. If you treat spoofing like a compromise, you reset passwords and scan laptops while the forged emails keep going out. Both waste the day. So take ten minutes and find out which one you have.

The ten-minute test

1. Look in your Sent Items and Deleted Items. If the strange messages are there, someone sent them from inside your account. That’s a compromise. Stop reading here and go to the compromise section.
2. Look at your mailbox rules and forwarding (in Outlook on the web: Settings, Mail, Rules and Forwarding; in Gmail: Settings, See all settings, then the Filters and Blocked Addresses tab and the Forwarding and POP/IMAP tab). Rules you didn’t create that forward, delete or hide mail are a strong sign of compromise, even if Sent Items looks clean, because attackers often delete what they’ve sent.
3. Check your recent sign-ins. On Microsoft 365, mysignins.microsoft.com lists recent activity; on Google, the Security page of your account shows recent security events and devices. Sign-ins from places or devices you don’t recognize point to compromise.
4. Get a copy of one of the suspicious emails from someone who received it, or open one of the bounce-backs, and look at the message headers (in Outlook, “View message details”; in Gmail, “Show original”). Look for the lines that report SPF, DKIM and DMARC results. If they say fail, and the message came from a server that isn’t Microsoft’s or Google’s, it was very likely forged outside your account.
5. Look at the actual address, not just the name. If the email shows your name but an address like [email protected], nobody has touched your account or your domain. That’s display-name impersonation, a third case I’ll cover below.

If your IT provider has admin access, they can do this faster with a message trace in Microsoft 365 or the email log search in Google Workspace, which shows whether a message ever passed through your systems at all. If it didn’t, it wasn’t sent from your account.

If it’s a compromise

Treat it as an incident, today. From a clean device, reset the password and have an admin revoke all sessions, because a password change alone doesn’t throw out someone who is already signed in. Remove any mailbox rules and forwarding you didn’t create, any phones or authenticator apps that aren’t yours, and any apps with permission to read your mail. Then look at what the attacker could see and who they wrote to. Warn anyone who received a message from the account, by phone if it involved money or bank details, and call your bank the same day if a payment might have gone out.

Our guide to what to do if your business email is hacked has the full sequence. Depending on what was in the mailbox, you may also have notification duties under state law or your contracts; that’s a question for your lawyer and your cyber insurer, and this is general information rather than legal advice.

If it’s spoofing

Here the premise is simple. Email was designed in an era when everyone on the network trusted everyone else, so the “From” address is just text that any server can fill in. The catch is that your domain’s DNS records are what tell receiving servers which senders are genuine, and many small business domains either don’t publish them or publish them in a permissive “just monitor” mode. Three records do the work. SPF lists the servers allowed to send mail for your domain. DKIM adds a signature to each message so receivers can check it really came from you and wasn’t altered. DMARC ties the two together: it tells receivers what to do when a message claiming to be from your domain fails those checks (nothing, junk it, or reject it) and sends you reports about who is sending as you.

Worked example: tightening DMARC step by step

Picture a company on Microsoft 365 that also sends invoices from QuickBooks and newsletters from Mailchimp. Here’s the order I’d follow.

1. List every service that sends email as your domain. Microsoft 365, the accounting system, the email marketing platform, the website’s contact form, the copier that scans to email. People always forget one.
2. Make sure SPF includes all of them in a single record (only one SPF record per domain is allowed), and turn on DKIM signing in Microsoft 365 and in each service that supports it.
3. Publish a DMARC record in monitoring mode, something like v=DMARC1; p=none; rua=mailto:[email protected], and read the reports for two to four weeks. They’ll show both your legitimate services and the forgers.
4. Fix any legitimate sender that fails, then move to p=quarantine, so failing mail goes to junk.
5. After another few weeks of clean reports, move to p=reject, so forged mail claiming to be your domain is refused outright by receivers that honor DMARC.

Two things worth knowing. First, Google’s sender rules (in force since February 1, 2024) already require SPF or DKIM from everyone sending to Gmail, and SPF, DKIM and DMARC from anyone sending more than 5,000 messages a day, so this work also helps your own mail get delivered. Second, a policy of p=none protects nobody; it only watches. Our step-by-step DMARC setup guide covers the details.

The third case: your name, someone else’s address

A lot of searches for this problem are really about emails that show your name but come from an unrelated free address. “Hi, it’s Jayant, are you at your desk? I need a quick favor.” Nothing in your account or DNS is involved, so DMARC can’t stop it, because the forger isn’t using your domain. What helps is telling staff and key clients that you’ll never ask for gift cards, payments or bank changes by email, turning on the external-sender tag in Microsoft 365 (or whatever external-sender warning your email provider offers), and confirming any payment request by phone on a number you already had. Our guide to business email compromise prevention covers the payment controls.

Before it happens again

If you went through the test above and weren’t sure where to look, that’s worth fixing while things are calm. Our cybersecurity service covers email security, MFA, monitoring and a written recovery plan. Or start with our free Technology Health Assessment: 30 minutes of data collection, a plain-language report the next day that rates your email security along with the rest of your IT, and a short list of next steps in order. The report is yours to keep. Pick a time for the assessment.

Related services

• Cybersecurity services
• DMARC setup guide
• What to do if your email is hacked
• Email security for small business