You did not send that email.
But it came from your domain.
It had your name on it. It used your business address. It landed in your customer's inbox looking exactly like every other legitimate email you have ever sent them.
Domain spoofing is one of the most straightforward methods attackers use to run scams in a business's name.
And one of the least visible to the business is being impersonated.
And it's working because most businesses either do not have the right records in place or have them set up incompletely.
Most business owners assume that their email is protected because they have a professional domain and a business email address.
That assumption has a significant gap in it.
Having a domain does not automatically prevent someone else from sending emails that appear to come from it. Without the right authentication records in place, anyone with basic email knowledge can do exactly that.
They do not need access to your systems.
They do not need your password.
They just need to know your domain name.
This is one of the most common and overlooked email security risks facing businesses today, and one of the easiest for attackers to exploit without ever touching your systems.
Sending an email is not the same as owning a domain.
From your domain name alone, an attacker can send emails to your customers requesting payment to a new account. They can impersonate your leadership in messages to staff. They can target your vendors with fake invoice requests.
Everything looks like it came from you.
And your customers have no obvious reason to question it.
The three records that protect your domain each do a different job:
Most businesses either do not have all three in place or have DMARC set to monitor rather than block. That means spoofed emails are still reaching inboxes even when the other records exist.
Most of these fixes are straightforward. The important thing is knowing which ones you are missing.
Your domain is your business identity online.
If it is not protected, someone else can use it without your knowledge.
Knowing what is missing is the first step. Fixing it correctly is the next one.
You may also want to read:
Business Email Compromise Doesn't Start With a Hacker. It Starts With a Trusted Email. ➡️
At Aurora InfoTech, we are dedicated to helping business owners strengthen their email security and Cybersecurity defenses through proactive IT support and practical security solutions.
With our team of experts and comprehensive Managed IT Services, we help ensure your systems and data are protected against evolving cyber threats.