Anyone can put your business name in the "From" line of an email. That is how a lot of scams work: a fake invoice that looks like it came from a shop you trust, or a "password reset" that looks like it came from your own company. If your domain doesn't publish clear rules about who is allowed to send as you, the receiving inbox has to guess.
I set those rules up months ago on my own domains and the ones I manage for clients, and told the big email providers to treat anything that broke them as spam. Part of that setup is a daily report that Gmail mails back to you, listing every server that sent mail claiming to be you, and whether it passed. I had 124 of those reports piling up in a mailbox and had never actually read them.
So I finally did. The off-the-shelf tools for this want a monthly subscription to turn the reports into charts. I didn't need charts. I needed a straight answer to two questions: is anyone pretending to be me, and is any of my real mail failing?
How the System Works
- One Mailbox Collects Everything: Almost every domain sends its daily reports to one dedicated mailbox, so there's one place to look instead of one per domain.
- A Simple Tally: I pull the attachments out of that mailbox and count every message by domain, by sending server, and by pass or fail. Two and a half months of reports turned into one short list.
- Clear Rules Published for Each Domain: Each domain tells receiving inboxes exactly which email service is allowed to send for it, and to send anything else to spam.
Overcoming the Friction
1. A Permission Slip Nobody Was Using
The reports showed every real message going out through the same email service, and all of them passing. That was the good news. The surprise was what the list didn't show: my domains still gave permission to the old email host I had moved away from months ago. Nothing had been sent through it since. That leftover permission meant anyone with an account on that old host could have sent mail that looked legitimate as me. I removed it from the domains that had fully moved, and moved my store's inbox off the old host so I could remove it there too. Then I sent test messages to make sure real mail still landed in the inbox, not spam.
2. One Domain Was Missing Its Permission Note
When a domain's reports go to a mailbox on a different domain, that receiving domain is supposed to publish a one-line note saying "yes, I accept reports for this one." Without it, some email providers quietly skip sending reports at all. One client's domain was missing that note. Gmail happened to send its reports anyway, but I didn't want to count on that. It took a minute to add.
The Business Win
In two and a half months there was not a single attempt by anyone else to send email as any of my businesses, and every real message passed. That's the answer I wanted, and it took one afternoon and no subscription. Closing the leftover permissions and moving that inbox means all but one of my domains now send and receive through a single email service. The one holdout is our family domain, which moves once we've sorted out everyone's inboxes together.
If you run a small business, ask whoever handles your email one question: "Who is allowed to send email as us, and when did anyone last check?" Next, I'm testing a small tool I built that walks other business owners through setting up these same rules on their own websites, step by step.
Top comments (0)