In this article (15 sections)
A customer calls your office. They want to know why they got an invoice from your email address for a job you never did. You didn't send it. Someone else did, using your domain, and nothing in your setup told their inbox to turn it away.
That is email spoofing, and we wanted to know how exposed local businesses are. So we read the public DNS records of 466 Orange County businesses that receive email on their own domain, on 4 November 2026. Here is what we found, how to check your own domain, and the order to fix it in.
Quick answer: 83.5% of the 466 local business domains we checked can't stop email spoofing: 47.9% have no DMARC record, 35.4% have one set to p=none (watch only), and 1 is invalid. Only 16.5% tell inboxes to quarantine or reject a fake. The fix is three DNS records and a few weeks of reports, not a new website.
Not sure where your domain stands? We'll check your SPF, DKIM and DMARC with your website and tell you what to fix first, even if you never hire us. Get a free website and email check
What we found: email spoofing protection at 466 local businesses
Short answer: fewer than 1 in 6 local business domains enforce DMARC, the one record that tells Gmail and Outlook to block a fake email in your name.
We took the 560 live business domains from our 662-site Orange County website study (an OpenStreetMap listing, chains removed, crawled in September 2026). 466 of them have MX records, which means they receive email on their own domain, like info@theirbusiness.com. Every rate below is out of those 466. We read the records through public DNS, the same lookup anyone can run.
| DMARC status | Domains | Share of 466 |
|---|---|---|
| No DMARC record at all | 223 | 47.9% |
| p=none (monitor only) | 165 | 35.4% |
| Invalid record | 1 | 0.2% |
| p=quarantine | 35 | 7.5% |
| p=reject | 42 | 9.0% |
| Not protected (first three rows) | 389 | 83.5% |
Sources: RankMeHi study of Orange County local business domains, DNS checked 4 Nov 2026 via public DNS. 73 of the 77 enforcing domains (15.7% of 466) apply their policy to 100% of mail.
The pattern is simple. Most owners either never published DMARC or published it and stopped at the first step.
What is email spoofing, and why are local businesses a target?
Short answer: email spoofing is a message that shows your domain in the From line but was sent by someone else, and local service businesses are easy targets because customers already expect invoices and reminders from them.
A spoofed email from info@yourbusiness.com can ask a customer to pay an invoice into a new bank account. It can ask your bookkeeper to wire money. It can send a fake appointment link that steals a password.
The attacker doesn't break into your inbox. They type your domain into the From field of their own mail server. Whether that message lands, bounces or goes to spam depends on three DNS records: SPF, DKIM and DMARC.
A law office, a dental clinic and an auto shop all trade on trust with repeat customers. That trust is the target, not your server.
What do SPF, DKIM and DMARC actually do?
Short answer: SPF lists the servers allowed to send for your domain, DKIM signs each message so it can't be changed in transit, and DMARC tells the receiving inbox what to do when a message fails both.
Think of a front desk:
- SPF (Sender Policy Framework) is the guest list. It names the servers allowed to say they're you.
- DKIM (DomainKeys Identified Mail) is the wax seal. It proves the message wasn't altered after it left.
- DMARC (Domain-based Message Authentication, Reporting and Conformance) is the instruction you leave with the desk: let it in, hold it, or turn it away. The standard is RFC 7489.
None of the three works alone. A domain can have a perfect SPF record and still be spoofed if DMARC isn't set to enforce. A guest list nobody checks is a piece of paper, not a door.
Finding 1: Almost half have no DMARC record at all
Short answer: 223 of 466 domains (47.9%) publish no DMARC record, so the receiving inbox gets no instruction when a fake email in their name arrives.
No record isn't neutral. When Gmail or Outlook looks for DMARC and finds nothing, it falls back on its own filters. Some fakes get caught. Some land in your customer's inbox looking exactly like you.
Add the SPF side and the picture gets worse. 76 domains (16.3%) have no SPF record, 63 (13.5%) have neither SPF nor DMARC, and 12 publish two SPF records, which breaks SPF completely because a domain may only have one.
Five-minute check: look up the TXT record for _dmarc.yourdomain.com in any free DNS lookup. Nothing back means you're in this 47.9%.
Finding 2: A DMARC record set to p=none is a security camera with no lock
Short answer: 165 of 466 domains (35.4%) have a DMARC record set to p=none, which reports on fake mail but delivers every message anyway.
Many owners think any DMARC record means they're covered. It doesn't. p=none is step one of the setup, the watching phase. It is meant to last weeks, not years.
"A DMARC record set to p=none is a security camera with no lock. It films the break-in. It doesn't stop it." (Mohammad, RankMeHi)
Even the watching is often switched off. Of the 243 domains with any DMARC record, only 129 ask for aggregate reports (the rua tag), the daily feed that shows who is sending mail as your domain. The other 114 have a camera with no tape.
Only 77 domains (16.5%) set p=quarantine or p=reject, the two settings that actually move or block a fake.
Finding 3: Google mail domains were the least protected of the big providers
Short answer: of the 164 domains that get their mail through Google, only 18 (11%) enforce DMARC and 77 (47%) have no DMARC record at all.
We grouped domains by their first MX record, which shows who handles their mail.
| Mail provider (first MX) | Domains | Enforce DMARC | No DMARC record |
|---|---|---|---|
| 164 | 18 (11%) | 77 (47%) | |
| Microsoft | 124 | 31 (25%) | 60 (48%) |
| GoDaddy | 18 | 2 (11%) | 15 (83%) |
| Other hosts | 160 | 26 (16%) | 71 (44%) |
Sources: RankMeHi study, DNS checked 4 Nov 2026; first MX record of each domain.
Microsoft-hosted domains enforced at more than twice Google's rate, 25% against 11%. Neither provider turns DMARC on for you. If your mail runs on Google Workspace, assume you're in the gap until you check.
Finding 4: Which local industries are most exposed to email spoofing?
Short answer: beauty and salon businesses were the least protected (5 of 56 enforce, 8.9%), and professional offices the most (17 of 87, 19.5%), but no industry reached 1 in 5.
| Industry | Domains with email | Enforce DMARC | Share |
|---|---|---|---|
| Professional offices (law, accounting, insurance, real estate) | 87 | 17 | 19.5% |
| Health clinics | 127 | 20 | 15.7% |
| Auto repair | 47 | 6 | 12.8% |
| Beauty and salons | 56 | 5 | 8.9% |
Sources: RankMeHi study, DNS checked 4 Nov 2026; industry from the OpenStreetMap category of each business.
Clinics and law offices send the emails a scammer most wants to copy: bills, intake forms, settlement details. If you run one, a fake invoice in your name costs a customer money, not just a missed message.
How do I check my own domain for email spoofing in five minutes?
Short answer: look up two TXT records in any free DNS lookup tool, _dmarc.yourdomain.com and yourdomain.com, and read the p= tag and the end of the SPF line.
- Look up the TXT record on _dmarc.yourdomain.com. Nothing back means no DMARC record (the 47.9% group).
- If a record comes back, find p=. p=none watches only. p=quarantine sends fakes to spam. p=reject blocks them.
- Check for rua= in the same record. No rua means nobody gets the reports.
- Look up the TXT records on yourdomain.com and find the one starting v=spf1. None means no SPF (16.3% of our sample). Two of them means SPF is broken.
- Read the end of the SPF line. -all is a hard fail (144 domains in our study). ~all is a soft fail, weaker (236 domains).
Write the five answers down. That list is the brief for whoever fixes it.
Found p=none, or nothing at all? Send us your domain. We'll read the records, list every service that sends mail as you, and give you the safe order to enforce. Get a free website and email check
In what order should you fix it, and what can break?
Short answer: fix SPF, turn on DKIM, publish DMARC at p=none with reports, then move to quarantine and finally reject, because jumping straight to reject blocks your own legitimate mail.
- SPF first. List every service that sends mail for your domain: the mailbox host, the booking tool, the invoicing app, the website form. Miss one and its mail starts failing.
- DKIM second. Turn on signing in each service's settings. This rarely breaks anything, because it only adds a signature.
- DMARC at p=none, with rua. Watch the reports for two to four weeks. This is where the forgotten senders show up.
- p=quarantine. When the reports show only your own services passing, send failures to spam.
- p=reject. Full enforcement. Fakes get refused at the door.
The order matters more than the speed. Reject with an incomplete SPF list blocks your own invoices and appointment reminders, not just the fakes.
Why big inboxes started caring in 2024
There's also a deadline effect. Since February 2024, Google's sender guidelines and Yahoo's sender best practices require bulk senders (more than 5,000 messages a day to their users) to publish SPF, DKIM and DMARC. Most local businesses are far below that volume, which is likely why so many never set it up. The same records also decide whether your own confirmations reach the inbox, which we cover in why emails go to spam.
What can break at each step
| Fix step | Typical time | What can break | How you'll know |
|---|---|---|---|
| SPF | 1 hour | A forgotten sender fails | Test email shows SPF PASS |
| DKIM | 1 hour per service | Rarely anything | Test email shows DKIM PASS |
| DMARC p=none + rua | 15 minutes, then 2-4 weeks of reports | Nothing (watch only) | Daily reports arrive |
| p=quarantine | 15 minutes | Unlisted senders go to spam | Reports show only your services |
| p=reject | 15 minutes | Unlisted senders are refused | Reports clean for 2+ weeks |
Sources: times are our own working estimates for a small business with 2 to 5 sending services; the steps follow RFC 7489.
When you don't need to worry about email spoofing
Short answer: if your DMARC record says p=reject, covers 100% of mail and sends reports to someone who reads them, you're in the small group our study found protected.
Keep an eye on the reports every few months and whenever you add a new tool that sends email, such as a new booking system. Otherwise there's nothing urgent to fix, and you don't need to pay anyone for it.
What RankMeHi does about it
Short answer: RankMeHi, a web design and SEO studio in Orange County, California, checks your SPF, DKIM and DMARC as part of a free website audit and fixes them in its audit and fix service from $490.
The free audit comes back within one business day. It covers your email records next to your site speed, your forms and your search visibility, because a quote form that sends to spam is a website problem too.
If you want it fixed, audit and fix starts at $490, takes 1 to 2 weeks and has no hourly rate. We list your senders, set the records, watch the reports and move you to enforcement in the right order. If you're rebuilding the site anyway, we set this up as part of our web design and web development work.
Key takeaways
- 83.5% of 466 Orange County local business domains can't stop email spoofing (DNS checked 4 Nov 2026).
- 47.9% have no DMARC record; 35.4% stop at p=none, which watches and blocks nothing.
- Only 16.5% enforce quarantine or reject; Google-hosted domains enforce at 11%, Microsoft at 25%.
- No industry in our sample reached 1 in 5 domains enforcing; salons were lowest at 8.9%.
- Fix order: SPF, DKIM, DMARC p=none with reports, quarantine, reject. Skipping steps blocks your own mail.
FAQ
Does having a DMARC record mean my business is protected from email spoofing?
No. A DMARC record set to p=none only reports on fake mail; inboxes still deliver it. Only p=quarantine or p=reject moves or blocks a fake. In our study of 466 local business domains, 165 (35.4%) had a DMARC record set to p=none, which leaves them as exposed as having no record.
How much does it cost to stop email spoofing?
The DNS records cost nothing to publish; your domain host lets you add them for free. The cost is the time to list every sending service, set the records and watch reports before enforcing. If you'd rather hand it off, RankMeHi's audit and fix service starts at $490 with no hourly rate.
How long does it take to go from no DMARC to p=reject?
Plan on four to eight weeks. The records take an afternoon, but the reports need two to four weeks at p=none and another stretch at quarantine before you can be sure every legitimate sender passes. Rushing to reject is the common way businesses block their own invoices.
What happens if I set DMARC to reject too soon?
You can block your own mail. If a booking tool, invoicing app or website form isn't in your SPF record and doesn't sign with DKIM, its messages fail and get refused along with the fakes. That's why the safe order runs through p=none with reports first.
Is email spoofing a real risk for a small local business?
Yes. Our sample was clinics, salons, law and accounting offices, auto shops and trades, none of them large companies, and 83.5% of the 466 with their own email domain had no enforced protection. Small businesses send invoices and reminders customers trust, which is exactly what a spoofer copies.
Can I check whether my domain is protected without technical help?
Yes. Look up the TXT record for _dmarc.yourdomain.com in any free DNS lookup tool and read the p= value, then find the v=spf1 record on your main domain. Or send an email to a Gmail address, open it, choose Show original, and read the SPF, DKIM and DMARC lines.
Cite this study
RankMeHi, "Email spoofing protection at Orange County local businesses," DNS checked 4 November 2026 via public DNS. Sample: 466 of 560 live business domains from the RankMeHi 662-site Orange County website study that receive email on their own domain. You're welcome to quote these numbers with a link to this page.
Close the door before someone walks through it
Most local businesses have the guest list, some have the camera, and very few have the lock. Five minutes tells you which one you have. If the answer is p=none or nothing, send us your domain for a free website and email check and we'll tell you exactly what to set, in order.
Services mentioned in this article
RankMeHi designs and builds business websites, then makes sure they are found and convert. Start with the two pages below.
Keep reading
Emails Going to Spam? Why Local Business Confirmations Vanish, and How to Fix It
Emails going to spam? 47.9% of 466 local business domains we checked have no DMARC record. Run the 5-minute Gmail test and fix the 6 causes in order.
Read article
We Tested 662 Local Business Websites in Orange County. Here's What Actually Works
Local business website study 2026: we tested 662 Orange County sites. 15% don't load, 26% lack tap-to-call and only 7% pass Google's mobile speed test.
Read article
Why Your Website Isn't Bringing You Leads — and What to Fix First
A website that doesn’t generate leads often has three major problems: poor design that reduces trust, low search visibility that limits traffic, and unclear calls-to-action that fail to convert visitors. Fixing these in order — starting with design, then SEO, then conversion elements — improves results faster than tackling them randomly. You built the website. …
Read article
Website Maintenance Services: What's Included, What It Costs, and What Happens If You Skip It
What do website maintenance services include, and what should they cost? See 2026 prices, a monthly checklist, and how to choose a plan that protects leads.
Read article