Blog

Built this week · That's something I need

Who else can send email as your business?

By Chad Maxwell, Prompt Works Studio, Toowoomba · Published 13 November 2026
Drafted with AI, approved by Prompt Works Studio.

Did you know anyone can send an email that says it's from your business?

What I set out to fix

Plain email lets the sender type whatever they like in the "from" line, the same way you can write any return address on an envelope.

Scammers use that. An email that looks like it's from you, asking your client to pay or to send something, is more likely to be believed.

There's a setting that tells other mail systems what to do with those fakes. It's called DMARC, and it's a short line of text on your web address. This morning, mine went to the strictest setting: reject.

How I did it

When I set up Microsoft 365 for my business email on 30 September, the domain came with a ready-made email security setting from my domain company, already on reject. I took it off so Microsoft's mail would work, and built it back up step by step. Here's why.

DMARC leans on two other checks. One checks the mail came from a server you've allowed (SPF). The other checks a signature your mail system puts on each email (DKIM). Your real mail passes if either one checks out for your address. If something sending in your name passes neither when you switch on reject, your own real mail can get bounced.

So I followed Microsoft's own advice and did it in three steps:

The reports are the key part. Google and Microsoft send a small file listing the mail they've seen from my address and whether it passed. They go to their own address, and a rule files them in their own folder.

What went wrong, and the fix

Two things.

First, I moved to quarantine too soon. On 30 October I read one report, from Google, covering one email. It passed, so I stepped up. Three earlier reports sat unread. Nothing broke, but one email isn't much proof, and I knew it.

So this time I read every report before touching anything. That's where the second problem came in. The reports arrive as attachments, and the tool Claude uses to read my Outlook couldn't open them. So Claude downloaded all seven through Outlook in my browser and added them up.

Seven reports, 20 emails, every one passed both checks, and every one came from Microsoft's own servers. Nothing else turned up in the reports sending as me. Then I changed the line and checked it was live.

What I learnt

The change itself is one line. The work before it is reading the reports, to be sure my own mail would still get through.

One good result isn't enough to step up on. I'd tell a client that, and I didn't do it myself the first time.

The thing to watch when you step up is your own real mail. A booking system, an invoicing app or a website form that sends in your name, and isn't set up for these checks, can start landing in junk or bouncing. I only had Microsoft sending for me, so mine was simple.

DMARC also has limits. It works on your exact address. It doesn't stop a scammer who sets up a look-alike address, or one who gets into your real email account. The Australian Signals Directorate's own example of invoice fraud is the second kind: a supplier's email account broken into, and real invoices sent out with the bank details changed.