Email Spoofing & DMARC: Stop Attackers Using Your Domain

Here's an uncomfortable fact about email: the "From" address is, by default, a claim — not a verified identity. Unless your domain enforces modern email authentication, anyone on the internet can send messages that appear to come from your company. To your customers. To your suppliers. To your own employees.

What attackers do with your name

Invoice fraud. A supplier's customer receives a payment-details-change email "from" the supplier. The bank account is the attacker's. This scam quietly drains real money from real SMBs, and the impersonated company often learns about it only when an angry customer calls.

Internal impersonation. An email "from the CEO" asks finance for an urgent transfer or gift-card purchase. It didn't come from the CEO. It came from anyone, because nothing stopped it.

Reputation damage. Spam and phishing blasted out under your domain burns your sending reputation — and suddenly your legitimate invoices land in customers' spam folders.

What DMARC actually does

DMARC, built on SPF and DKIM, lets your domain publish an enforceable policy: mail that fails authentication should be rejected. Receiving servers worldwide then refuse the forgeries before any human sees them. It also gives you reporting — visibility into who is sending as your domain, legitimate and otherwise.

The catch: most domains either have no DMARC record or sit permanently at "monitor only," which observes the forgeries without stopping them. Getting to enforcement safely — without accidentally blocking your own newsletter platform or CRM — is the part that takes expertise.

What it costs

DMARC Protection at CyberOM is $495.00 per domain per month — managed configuration, the journey to enforcement, and ongoing monitoring. Pair it with Email Protection + App Security ($4.50 per user per month) for the inbound side, and both directions of email risk are covered for less than a sandwich per employee.

FAQ

We have SPF already — isn't that enough?

SPF alone is easily bypassed and breaks on forwarding. Enforcement requires the full DMARC layer on top of SPF and DKIM.

Will DMARC block our marketing platform or CRM emails?

Done correctly, no — the path to enforcement starts in monitoring mode precisely to identify and authorize every legitimate sender first. That's what the managed service is for.

How do we start?

Submit a request with your domain; our team responds within 24 hours.

See DMARC Protection →