Overview

Organizations may learn that messages appearing to come from their domain are being forged or impersonated.

Symptoms

• Users report inconsistent or failed access to the affected service, device, or application.
• Normal business or home workflows are interrupted, delayed, or no longer reliable.
• The issue may be isolated to one user or may affect multiple systems depending on the root cause.

Cause

Missing or incomplete SPF, DKIM, and DMARC records make it easier for attackers to spoof a domain successfully.

Resolution

Audit current DNS records, validate alignment, publish the proper authentication records, and monitor reports for ongoing abuse.

1. Confirm the exact symptoms and identify who or what is affected.
2. Check for recent changes such as updates, password changes, hardware swaps, DNS changes, or policy adjustments.
3. Test the most likely root cause first and document all findings clearly.
4. Apply the corrective action in the least disruptive way possible and verify the issue is fully resolved.
5. Record the final outcome, any user communication, and any recommended follow-up work.

Prevention

Maintain domain authentication records carefully and review them after mail platform, hosting, or provider changes.

When to Contact Support

If the issue continues after standard troubleshooting, affects multiple users, involves data loss risk, or raises security concerns, it should be escalated to a qualified technician promptly.