How to confirm it
Ask whoever received the suspicious message to forward you the full headers, not a screenshot. Look at the Return-Path field and the SPF/DKIM result reported by their mailbox provider — not the visible « From: » alone, which can be forged without any record actually being compromised.
Distinguish two very different situations: someone writing your name in the From: field from their own server (that is classic spoofing, and DMARC stops it), and someone who has compromised a real account of yours (DMARC cannot help; the messages genuinely are yours). The first shows up in your reports; the second is handled by changing passwords.
What is not enough
Reporting the message as spam protects that recipient’s mailbox. It protects neither your domain reputation nor the next person targeted by the same campaign.
What actually stops it
A DMARC policy at p=reject, aligned on SPF and DKIM, gets the message refused before it reaches an inbox — at every provider that enforces the policy, which includes the largest ones.
The trap of jumping straight to reject
Without first watching your own reports at p=none, you risk blocking your own legitimate mail that you had never identified — a forgotten marketing tool, an internal script, a contractor that has been sending in your name for years without anyone thinking about it.
The right sequence: publish p=none with a reporting address, let it run two to four weeks, identify every sender, fix what needs fixing, then tighten. The detail of each step. And if the reports look unreadable, start by learning to read them.
Clarsend shows you, before you move to reject, the full list of who already sends in your name — legitimate or not.
Laisser un commentaire