Guide

Scam emails are going out "from" your domain. Here's how to shut it down.

by Ken Armitt, Founder · updated 31 July 2026

Either your domain is being spoofed (the attacker needs no access to you) or your site or mailbox is genuinely compromised and sending mail. Check your mail logs and DMARC reports: real outbound spam from your server points to a mailer script or stolen credentials; spoofing with none of your own infrastructure sending is stopped with SPF, DKIM and a DMARC policy.

First: is it spoofing, or are you really sending it?

Spoofing forges your address on mail sent from someone else's server — your systems are untouched, your reputation still suffers. A real compromise means your site or mailbox is actually sending the mail. Your mail logs settle it: if you see the outbound messages leaving your server, it's real; if you don't but recipients still get "your" mail, it's spoofing.

If it's spoofing

You can't stop others from typing your address, but you can make the internet reject it. Publish an SPF record listing who may send for you, sign your legitimate mail with DKIM, and add a DMARC policy telling receivers what to do with mail that fails both — start at p=quarantine with reporting on, watch the reports, then move to p=reject. This is the single most effective fix for domain spoofing.

If your site is genuinely sending it

Something on your server is a mailer: an injected PHP script, a hijacked contact form, a compromised CMS account, or leaked SMTP credentials. Find it by correlating the outbound log timestamps with file changes and access logs, remove the mailer and its backdoor, rotate every mail and CMS credential, and close the entry point. Until the backdoor is gone, the spam resumes the moment you look away.