I checked the email of 22 firms: fake email can be sent in any of their names
None has asked mail systems to discard forged email in its name, and 20 would not even get a report if someone wrote in their name. Trade businesses outside Budapest, 27 October 2026, from public data.
- Written by
- Kristóf Karner — independent developer, Budapest
- Updated
- 27 October 2026
I looked at the email setup of air-conditioning, conservatory, shading and heating installers: 29 businesses, 22 of which send email from their own domain, such as an info@companyname.hu address. Not a single request went to the businesses' servers. The figures are aggregates, without names.
| Firms sending from their own domain | 22 of 29 |
|---|---|
| Set up to discard forged email | 0 |
| Get reports on who sends in their name | 2 |
| Have an anti-forgery setting that only watches | 8 |
| List which servers may send in their name | 19 |
What does it mean that fake email can be sent in their name?
Anyone can change the sender of an email, the way anyone can write any return address on an envelope. Whether such an email arrives depends on what the business asks of mail systems: a domain can be set up so that email that cannot be verified is discarded. None of the 22 asks for this, so the receiving mail system's own filter decides about a forged email: sometimes it goes to spam, sometimes it arrives.
And almost none would get a report
The same setting can also ask for reports on who sent email in the business's name. 20 of the 22 have no such request: if someone wrote to their customers in their name, they would get no report of it. Eight have an anti-forgery setting, but all of them only watch, and six of those lack the address the reports would go to.
For comparison
I checked the same at 37 web and marketing agencies and 45 municipalities that send from their own domain. 7 of the agencies and 10 of the municipalities are set up to discard forged email.
What can be done?
- ask for reports — from then on you can see who sends email in the business's name;
- lock down domains that are not used, so nobody can send in their name either;
- switch on discarding forged email, once every legitimate sender in the reports is in order.
A separate piece goes through it step by step; if you would rather do it with me, it is described on the email authentication page.
From here on, the technical terms and how the measurement was made. The point is above.
In technical terms
The setting against forged email is the DMARC record. All eight
records ask for monitoring mode (p=none): the receiving
server holds nothing back and only sends a report, if the record says
where. The list of servers is the SPF record: 19 of the 22 domains have
one; for a sender outside the list, 14 only flag it as suspicious
(~all), two ask for rejection (-all), two are
neutral (?all), and one points to the hosting provider's
shared record. SPF alone does not protect the visible sender address:
DMARC is what ties the check to it.
Of the 22 domains, 21 use the mail service of a hosting or website provider, and one uses Google's.
What I measured, and what not
Only public DNS lookups, through Cloudflare's resolver, on 27 October 2026. Per domain: whether it has email (MX), an SPF and a DMARC record, and which rule the DMARC record asks for. I did not measure DKIM, because that requires knowing the key's name, nor whether anyone has misused one of these names. The sample is small and not random; the figures show the state of the setup, not the number of abuses.
Questions on this topic
How do I find out whether fake email can be sent in my company's name?
From whether your domain is set up to discard forged email. Any public DNS checker shows this under the DMARC record; if you would rather not look yourself, write to me from your business address and I will check.
What is DMARC?
A setting at the domain that tells mail systems what to do with email that arrives in the business's name but cannot be verified: let it through, put it in spam, or discard it. It can also ask for reports on who sent email in the business's name.
How was this measured?
On 27 October 2026, with public DNS lookups only, through Cloudflare's resolver; not a single request went to the businesses' servers. For each domain I looked at email, SPF and DMARC, and at which rule the DMARC record asks for. I did not measure DKIM, because that requires knowing the key's name.