Can someone fake your business email? DMARC explained for Bakersfield owners

Anyone can type your email address into the "From" line of a message and hit send. Whether that fake message reaches your customer or bookkeeper depends on a setting most owners have never heard of. It is called DMARC, and you can check yours in about five minutes.

What a missing DMARC policy leaves open

Picture a packing house in Kern County. The office manager emails invoices to growers every week. A criminal sends those same growers a message that looks like it came from her address. It says, "Our bank account changed. Please pay the new account this time."

Nothing on your side told the grower's mail server to refuse that message. So the server has to guess. Sometimes it blocks the message. Sometimes it lets it through.

The Bakersfield Cybersecurity Report checked the public setup of 4,406 independent Bakersfield businesses on October 18, 2026. It found that 86% of the domains with readable email records (3,790 of 4,402) had no enforced DMARC policy. That means no instruction to mail servers to quarantine or reject mail that fails authentication. In fact, 68% had no DMARC record at all. Only 5.8%, about 1 in 17, published a reject policy.

This matters because of what the fake emails are usually after: money. The FBI's 2025 IC3 report counted $3.05 billion in reported business email compromise losses in 2025. Faked invoices and "we changed banks" notes are a big part of that kind of fraud.

What DMARC does

DMARC is a short note you publish in your domain's public records. It tells the world's mail servers what to do with email that claims to be from you but cannot prove it.

You pick one of three settings:

• None: Watch only. Fake mail is still delivered. This is where most people start.
• Quarantine: Fake mail goes to the spam folder.
• Reject: The receiving server refuses the fake mail. It never reaches the inbox.

Quarantine and reject are the ones that count. A setting of none is better than nothing, because you can get reports. But it does not stop anything.

A dental office is a good example. Patients get appointment reminders and billing notices from the office's address. With reject in place, a criminal pretending to be that office has a much harder time reaching those patients.

What DMARC does not do

DMARC is useful, but it is one lock on one door. It does not fix these problems:

• A hacked account. If a criminal steals your password and logs in, the mail really does come from you. DMARC will pass it. Strong passwords and two step sign in are what protect you here.
• A lookalike domain. A criminal can register something close to yours, like a swapped letter or an added word, and send mail from that. It is a different domain, so your DMARC policy does not apply to it.
• Everything bad in your own inbox. DMARC protects people who get mail pretending to be you. It does not filter the junk coming in to you.

Also, Google and Microsoft filter on their own. They catch plenty of fakes even when a domain has no policy. But they are guessing. DMARC lets you give them a clear instruction instead.

How to check your own business

You do not need to be technical for the first part.

1. Search for "DMARC check" and pick any free lookup tool.
2. Type in your business domain, the part after the @ in your email address.
3. Look at the result. If it says no record found, you have no policy. If you see p=none, you are watching only. If you see p=quarantine or p=reject, you are enforcing.

Then ask who sends email as your business. That could be your own staff, your invoicing software, an email marketing service, or a scheduling tool. Each one has to be set up properly first. If you jump to reject too fast, you can block your own real invoices.

The safe path is to start at none, read the reports for a few weeks, fix any real senders that fail, then move to quarantine, then reject. If you use a trucking dispatch system or a restaurant ordering service that sends mail for you, add those to your list.

Many owners would rather hand this off. If that is you, get in touch and we can do it with you. Your email should keep working the whole way.

One more number from the report: of the businesses where all five could be checked, only 8.5% (fewer than 1 in 11) passed five basic, free security checks. If your DMARC is missing, you are in the large majority. It is also very fixable.

If you want to know where you stand, Mitivanta offers a free check of your business's public email setup. We will tell you plainly what we find and what to do first. No pressure, just a clear picture.