The phone call is always the same: a customer rings to confirm an invoice you never sent, with your name in the sender and a bank account that is not yours. Or a supplier says they have received updated payment instructions from you.
The immediate question — "have we been hacked?" — nearly always has the answer no. Sending email with your domain in the sender requires getting into no account at all.
Why it is possible
Email was designed in an era when nobody expected anyone to lie. A message's "From" field is text written by whoever sends it: anyone can put anything there, like the return address on the back of an envelope.
There is no intrinsic check. The only checks that exist are the ones you publish in your domain's DNS, and if you have not published them, the receiving server has no way of knowing that the message is not from you.
An important consequence follows: this defence is not bought and not installed. It is configured, and it is free.
Two variants, defended differently
Direct use of your domain. The sender is exactly name@yourdomain.com. This is the most damaging case and, paradoxically, the easiest to close: it is precisely what DMARC exists to prevent.
Lookalike domains. The sender is yourdomain-ltd.com, your-domain.com, or yourdomaín.com with a nearly invisible accented letter. DMARC can do nothing here: that is a different domain, and you have no authority over somebody else's domain. The defence for this is different, and comes at the end.
It is worth establishing which of the two is happening before deciding what to do, and you establish it by reading the headers of the offending message — not the display name, which is cosmetic, but the real address.
The sequence that closes the door
Closing direct use of your domain takes three DNS records and some patience. The patience is the important part: done in a hurry, this work blocks your email rather than everybody else's.
1. Take a census of who sends legitimately. Before telling the world "reject anything unauthenticated", you have to know what authentic looks like. In companies it is always more systems than expected: company mail, the ERP, the shop, the newsletter platform, the invoicing service, the website form, the CRM.
2. Fix SPF and DKIM for each of them, checking alignment and not merely that the check "passes". This is where most configurations go wrong.
3. Publish DMARC in observation mode. It blocks nothing. It only asks recipients to send a daily report on what they see arriving in your name.
4. Read those reports for two or three weeks. Two things happen at once here: you find the forgotten legitimate senders, and you see who is impersonating you — volumes, IP addresses, countries.
5. Tighten the policy, first to quarantine and then to reject, once the reports say every real sender is in order.
At the end of that sequence, an email claiming to come from your domain without doing so is refused by the receiving server. It does not land in spam: it does not arrive at all.
What this actually changes
It is worth being precise about the outcome, because the marketing around this subject promises too much.
What it solves: nobody can use your exact domain in the sender any more, towards recipients that apply DMARC — which by now is nearly every large provider.
What it does not solve: lookalike domains, mail sent from a genuinely compromised account (that mail is authentic, and DMARC approves it), and scams that use your name in the body rather than your domain in the sender.
It is still the best cost-to-result defence that exists in email: three records and a few weeks of attention.
Lookalike domains
For these the defence is different in nature, and partly a budget decision.
You can register the obvious variants in advance — with and without a hyphen, the parallel extension, the most likely typo. Not all of them: somebody determined to defraud you will always find a free variant, and buying twenty domains for protection is a spend without end. Two or three genuinely close ones are reasonable, and they get managed alongside the rest of the domain portfolio.
You can monitor for lookalike domains appearing, and act when one does.
And you can, when it is warranted, ask for one to be removed: registries have procedures for names registered in bad faith, and anyone able to demonstrate a trademark or a company name has an argument.
The non-technical part, which stops the real frauds
The frauds that actually cost money — where a payment goes to the wrong bank account — are not stopped by DNS records. They are stopped by one simple company rule, written down and known to whoever pays:
A change of bank details is never accepted by email. It is verified with a phone call to a number already known, never to the number given in the message.
It costs nothing and blocks the most profitable category of fraud there is. The DNS records take away the attacker's most convincing tool; that rule makes even the best-executed attempt useless.