# Someone is sending emails pretending to be your company.

> If a customer forwarded you a scam email that looks like it came from your own address, your account almost certainly wasn't compromised. Anyone can put any "From" address on an email - the question is whether your domain's own records let receivers tell the difference.

## What's actually happening

Email's "From" address was never designed to be trustworthy on its own - it's closer to the return address written on a paper envelope: anyone can write anything there. Three records in your domain's DNS are what let a receiving mail server tell real mail from forged mail: SPF (who's allowed to send), DKIM (a signature proving the message wasn't altered), and DMARC (what to do when a message fails both).

If your domain has no DMARC policy, or one set to `p=none`, forged mail using your domain name gets delivered exactly like real mail would. That's what's happening right now if this is news to you.

## See where you actually stand

Type your domain into the checker. In a few seconds you'll see your current SPF, DMARC and MX records read live from public DNS, and exactly where you sit: no policy, `p=none` (reporting only, not blocking), `p=quarantine`, or `p=reject` (forged mail gets refused outright).

## Shutting it down without breaking your own mail

Jumping straight to `p=reject` is tempting but risky: if you have a sender you forgot about - a marketing tool, a support desk, a billing system - sending mail using your domain that isn't yet aligned, you'll block your own legitimate mail along with the forged kind.

The safe order: publish a policy that only reports (`p=none`), read a week or two of reports to find every real sender, align each one, then move to quarantine and finally reject. The full walkthrough is in [moving DMARC from none to reject safely](/learn/dmarc-none-to-reject).

## If it's actively happening right now

Forged mail using your domain doesn't mean your mailbox or password is compromised - don't waste time on a password reset. Do: warn customers who reported it not to click anything in those messages, and move your DMARC policy toward enforcement as fast as your legitimate senders allow.

## Questions

**Does this mean my email account was hacked?**
Almost certainly not. Spoofing forges the visible "From" address on a message sent from somewhere else entirely - it doesn't require access to your account.

**Will changing my password stop it?**
No. The forged messages aren't coming from your account, so nothing about your account's security changes whether they can keep doing it. SPF, DKIM and DMARC are what actually stop it.

**How fast can I stop it?**
It depends on your current DMARC policy. If one's already enforcing at p=reject, forged mail is already being refused. If you have none, it takes finding and aligning every legitimate sender first - see the DMARC checker for where you stand today.

Tool: [Check your domain's posture right now](https://www.emcheq.com/tools/dmarc-checker)