In this guide · 7 sections
Short answer
Check the mailbox's Sent Items and your admin console's message log first. If the emails are there, the account is compromised: reset the password, sign out all sessions and remove rogue rules. If they are not, it is spoofing: publish SPF and DKIM, then move your DMARC policy to p=reject.
First 15 minutes: spoofing or a hacked mailbox?
The two causes look the same to your customers but need different fixes. Work through these checks before changing anything:
Get a copy of one fake email
Ask a recipient to forward it as an attachment, or send a screenshot plus the full headers (in Outlook: File, Properties; in Gmail: Show original).
Look in the sender's Sent Items
Sign in to the mailbox that supposedly sent it. If the fake message, or similar ones, are in Sent Items or Deleted Items, someone has used the real account.
Search your admin message log
In Microsoft 365, use message trace in the Exchange admin centre; in Google Workspace, use Email Log Search. If the message passed through your system, it came from inside.
Read the authentication results in the headers
Find the Authentication-Results line. spf=fail, dkim=none or fail, and dmarc=fail usually mean the message was sent from a server you do not control: spoofing.
Check the From address carefully
Is it exactly your domain, or a lookalike such as rn instead of m, or an extra -sg? A lookalike is not spoofing your domain; it is a separate domain someone registered.
| What you find | Likely cause | Go to |
|---|---|---|
| Fake emails in Sent Items or the admin message log | Compromised mailbox | Hacked account steps below |
| Not in Sent Items; headers show SPF or DMARC fail | Spoofing your exact domain | DMARC section |
| From address is a slightly different domain | Lookalike domain | Lookalike section |
| Lots of bounce messages for mail you never sent | Spoofing (backscatter) | DMARC section |
If the mailbox was hacked: contain it first
A compromised mailbox is the more serious case, because the attacker can read past emails, reply inside real threads and change invoices. Contain it before you do anything else:
- Reset the password and sign the user out of all sessions in the admin console.
- Check and remove MFA methods, app passwords and connected apps you do not recognise.
- Delete inbox rules that forward, move or delete messages, and check mailbox-level forwarding.
- Review sign-in logs for unfamiliar countries or devices, and turn on MFA for every user if it is not already on.
- Search Sent Items for every message the attacker sent, so you know who to warn.
Our full hacked business email guide covers the first hour step by step for Microsoft 365 and Google Workspace, including whether you may need to notify the PDPC.
If it is spoofing: SPF, DKIM, then DMARC to reject
Email was designed without any check on the From address, so anyone can type your address into a mail server. Three DNS records fix that: SPF lists the servers allowed to send for your domain, DKIM signs your messages, and DMARC tells receiving servers what to do when a message claiming to be from you fails those checks.
Google's DMARC set-up page says DMARC tells receiving servers to reject, quarantine or deliver messages that fail SPF or DKIM, and that you must set up SPF and/or DKIM before DMARC or your own mail will have delivery problems. Microsoft's DMARC guide explains that with p=reject failing messages "are typically discarded", while p=quarantine usually sends them to junk.
| Record | Example value | What it does |
|---|---|---|
| SPF (TXT at your domain) | v=spf1 include:spf.protection.outlook.com -all | Lists servers allowed to send for you |
| DKIM | Enabled in Microsoft 365 or Google Workspace | Signs each message with your domain's key |
| DMARC, start | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.sg | Collects reports without blocking |
| DMARC, end goal | v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.sg | Asks receivers to reject forged mail |
If spoofing is happening right now and you know every service that sends for you (your email platform, newsletter tool, invoicing app, website forms), you can move to p=quarantine within days. If you are not sure, read the DMARC reports for a week or two first. Our DMARC policy guide explains how to move from none to quarantine to reject without blocking your own invoices.
What DMARC does not stop
DMARC protects your exact domain. It cannot stop someone sending from a different domain that looks like yours, or from a free email account using your company name as the display name.
DMARC at reject stops
- Forged mail using your exact domain in the From address
- Most backscatter bounces caused by spoofing
- Spoofed invoices to customers whose providers enforce DMARC
DMARC does not stop
- Lookalike domains (yourco-sg.com, yourc0.com)
- Free email accounts with your company name as display name
- Messages sent from a hacked mailbox inside your domain
- Receivers that do not check DMARC at all
For lookalike domains, the fix is reporting and takedown with the registrar and hosting provider. Our guide to lookalike domain impersonation covers how to do that.
Warn customers and report it in Singapore
Tell customers what happened without causing panic, and through a channel they already trust. A short notice on your website plus a direct message to affected customers is usually enough.
- Say that fake emails using your name are circulating and that you have not changed your bank details.
- Tell them how to verify: call your published number before paying any changed account.
- Never include a link to "check" anything in the warning email itself.
- If a customer lost money, ask them to report it to their bank and to the police.
- Report phishing or cyber incidents to SingCERT at singcert@csa.gov.sg; the CSA site also has incident response checklists.
If a mailbox was compromised and it held customer personal data, also assess whether the PDPA's data breach notification rules apply.
Do it yourself or get help?
If your email platform is the only thing that sends for your domain, publishing SPF, DKIM and DMARC is an hour's work with your DNS provider. It gets harder when several tools send as you, because a wrong SPF record or early reject policy can bounce your own invoices.
Spoofing fix checklist
Our Emails Land in Spam fix (S$249) sets up SPF, DKIM and DMARC correctly and monitors for 14 days before tightening the policy. If an account was taken over, Hacked Email Recovery (S$290) locks the attacker out and cleans up rules, sessions and MFA.
Frequently asked questions
Email does not check the From address by default, so anyone can type your address into their own mail server. That is spoofing. SPF, DKIM and DMARC records let receiving servers check whether a message really came from servers you authorise. With DMARC at p=reject, forged messages are typically discarded.
Look in the Sent Items and Deleted Items of the mailbox, and search your admin message log in Microsoft 365 or Google Workspace. If the fake emails appear there, the account was used and should be treated as hacked. If they do not, and the headers show SPF or DMARC failures, it is spoofing from outside.
This is called backscatter. A spammer sent messages with your address as the sender, and some recipients' servers bounced them back to you. It usually means your domain is being spoofed, not that your account is hacked. Publishing DMARC with a quarantine or reject policy reduces it over time.
It can, if a service that sends on your behalf is not covered by SPF or DKIM, such as a newsletter tool or invoicing app. Start with p=none and a reporting address, read the reports to find every legitimate sender, fix their records, and only then move to quarantine and reject.
You can report cyber incidents and phishing to SingCERT, part of the Cyber Security Agency of Singapore, at singcert@csa.gov.sg. If anyone lost money, they should contact their bank immediately and make a police report. Also report lookalike domains to the registrar and hosting provider.