If people are receiving emails from your address that you never sent, either someone outside is forging (spoofing) your domain, or someone has got into your real mailbox. Your Sent folder, recent sign-in activity and the message headers tell you which. A compromised account is urgent: secure it first, then tighten SPF, DKIM and DMARC to make forgeries harder.
Check your domain's records freeRequest helpSpoofing means someone outside your business sends mail that only claims to be from your domain. They never touched your mailbox. Email was designed without built-in sender checks, so any server can write your address in the From line. Whether the message gets delivered depends on how well your domain is protected and on the receiver's filters.
A compromised account means someone has your password or a live session and is sending from your real mailbox. Those messages come from your provider's servers, pass authentication and often go to your real contacts, sometimes as replies in existing threads. This is the more dangerous case, especially if they ask customers to pay an invoice to new bank details.
There are two lookalike cases worth knowing. A lookalike domain uses a name close to yours, with a swapped letter or a different ending. Display-name spoofing uses your business name as the sender name on a free email account. Neither touches your domain, so your DNS records can't stop them. Warning customers is the main defence.
| Check | Points to spoofing | Points to a compromised account |
|---|---|---|
| Your Sent folder | The messages aren't there. | The messages are there, though attackers sometimes delete them. |
| Bounce-backs | Bounces for messages sent to strangers or addresses that don't exist. | Possible too, if the attacker mailed a large list from your account. |
| Message headers | SPF or DMARC fails, or the sending servers aren't your provider's. | SPF, DKIM and DMARC pass, because the mail really came from your mailbox. |
| Who received them | Random or purchased lists. | Your real contacts and customers. |
| Sign-in activity | Nothing unusual. | Sign-ins from unfamiliar devices or locations. |
| Mailbox settings | Unchanged. | New forwarding addresses, filters or rules you didn't create. |
Ask someone who received the message to send you its full headers, or to forward it to you as an attachment. Ask them not to click links or open attachments in it. In Gmail, open the message and choose Show original. In Outlook, the headers are under the message's properties or details view, depending on the version.
Look for the Authentication-Results line added by the receiver. It shows results such as spf=pass or spf=fail, dkim=pass with the signing domain after d=, and dmarc=pass or dmarc=fail. If DMARC failed and the Received lines show servers that have nothing to do with Google, Microsoft or your provider, it's almost certainly spoofing. If everything passes with your domain and your provider's servers, treat it as a compromised account until proven otherwise.
Before sharing headers with anyone, you can remove the recipient's address. The rest is safe to share and contains no password.
The three records work together. SPF lists the services allowed to send for your domain. DKIM adds a signature that proves a message came from a system holding your domain's key. DMARC checks that one of them passed for the same domain shown in the From address, and tells receivers what to do when neither did.
The protection comes from the DMARC policy. At p=none you get reports but forged mail is handled as normal. At p=quarantine or p=reject, receivers that enforce DMARC filter or refuse mail that forges your domain. Don't jump straight to reject: make sure your website form, invoicing tool and newsletter service all pass first, or you'll block your own mail.
Keep expectations realistic. Not every receiving server checks DMARC, so a little forged mail may still get through after you enforce a policy. And none of these records helps if the attacker is signed in to your real mailbox, because that mail passes every check. That's why securing the account comes first.
Our SPF, DKIM and DMARC help page explains each record. If the spoofing is producing a flood of bounces, the bounce-back guide explains which ones you can safely ignore.
AIVIQ is a Vancouver-based, remote email repair service. You can start by running the free public email check to see whether your domain has SPF and DMARC at all. Our authentication and deliverability repair starts at CAD $149 and covers SPF, DKIM and DMARC for one domain and up to three legitimate sending services. If we need to look inside your Google Workspace or Microsoft 365 admin settings, we use temporary delegated access that you remove after verification, never a password sent by email.
Yes. Basic email lets any server put any address in the From line. That is spoofing. SPF, DKIM and DMARC let receivers detect it, and a DMARC policy of quarantine or reject asks them to filter or refuse it.
Usually because someone spoofed your address and sent to addresses that don't exist, so the bounces come back to you. It is common and mostly harmless, but it's a good reason to check your DMARC policy.
Only when they forge your exact domain. It does not stop lookalike domains, such as an extra letter or a different ending, or a free account that uses your business name as the display name.
Usually not. If the account was compromised, securing it fixes the problem. If it's spoofing, changing address doesn't help because anyone can forge the new one too. Authentication records are the real fix.
No. Attackers often leave forwarding rules, app passwords or connected apps behind, and existing sessions can stay signed in. Work through every step, not just the password.
No. AIVIQ never asks for passwords by email. Headers and DNS can be reviewed without access, and any admin access needed is temporary and removed after the fix is verified.
Send us a redacted copy of the message headers and tell us what you're seeing. Never a password. We'll tell you which problem you have and what fixing it involves.
Request help