Company mail without DMARC: anyone can send letters "from you"

A customer receives a letter from your domain: an invoice, a change of bank details, "update your account password". The site has nothing to do with it, and nobody opened the director's mailbox. The letter was simply sent from someone else's server with your address in the from field. Large mail providers cut this better and better, but only if you yourself have said which servers are yours.

Three records, and the order matters. SPF lists who may send. DKIM signs the letter with the domain key. DMARC ties them together and tells the receiver what to do with a forgery: first only collect reports, then set them aside, then reject. Turning on a hard reject immediately is dangerous if a mailing tool, a CRM or the site also send mail and were left off the list. Find them first, then tighten the rule.

Where companies usually stumble

• The record exists, but the service you actually use was forgotten. Mail from forms starts to disappear.
• The signature covers only company mail, and the store sends receipts separately.
• Nobody reads the DMARC reports, so a forgery lives for months.
• The director's mailbox still has no second factor. Forging an address and stealing a mailbox are different troubles, often together.

Lexora checks the mail records together with the site: forms should arrive, and someone else's server should not easily pretend to be you. This is part of an audit and office protection, not a "five-minute blind setup". If fake invoices are already going to customers, incident response and a payment rule are needed in parallel, because a DNS record will not bring sent money back. The basic site audit is free for new clients. We look at mail in the same pass if it is on your domain.