The Free Email-Forgery Fix Most Domains Only Half Turn On
You know the email. Your account is locked, sign in now. It looks exactly like your bank sent it. The fix that stops those fakes has been free for fourteen years. Most companies only turned it on halfway.
The fix is one free line in your domain's public records.
cranswickplc@eu.cp-dmarc.com
ebee97aa64@rua.easydmarc.eu
The fix is called DMARC. It is one free line in your domain's public records. It tells every mail server what to do with mail faking your name: just watch it, send it to spam, or reject it.
68.4% of tracked domains never block a forgery.
Of the sixty-seven thousand domains one study tracked this year, nearly half have no such line. Another quarter published one but left it on just watch. Together, sixty-eight percent never block a single forgery.
The old check never looks at the name you actually see.
Why does a forgery get through? The older check only proves a message left an approved server for some domain. It never looks at the name you actually see. So a scammer passes that check with a throwaway domain, then writes your bank on the line you read. This fix checks the visible name, and rejects anything that doesn't match.
Turning the fix on for real means hunting down every real sender first.
So why stop at watch? Flipping straight to reject is dangerous. Do it too early and you block your own mail: newsletters, invoices, the help desk. First you have to find every real sender using your name. They all land in a daily report every domain gets, listing every source that sent mail as you. But those reports are scattered. From thirty-seven thousand records, the study found ten thousand different report addresses. More than eight thousand appear exactly once, as scrambled mailboxes with no owner. That is a research project, not a setting change. So it stays on watch, for years.
You can check any domain's setting yourself, for free.
You can check any domain’s setting yourself, for free.
You can check any domain yourself, even your own. One lookup shows watch, spam, or reject.
Free since 2012. Most domains still on just watch.
Free since 2012. Most domains still on “just watch.”
The fix has been free for fourteen years. Publishing it was never the hard part. Finishing it is a research task most teams never get to.
