Invoice fraud and fake “owner” emails hit Valley trades and professional offices hard. Here is what DMARC actually does, and how to tell if your domain is unprotected.
If you run a Phoenix-area business — HVAC, dental, law, real estate, construction — your email domain is probably more valuable to an attacker than your website.
The attack that costs a month of jobs
Someone emails your bookkeeper as “you,” attaches an unpaid invoice, and asks for a wire or ACH change. The message is not from your Gmail or Microsoft 365 account. It is forged to look like it came from your domain — and most Valley small businesses have nothing on the public DNS that tells receiving servers to reject that forgery.
That gap is exactly what DMARC (Domain-based Message Authentication, Reporting & Conformance) closes when it is set to enforce.
What we see on Phoenix health checks
On free external checks for Arizona small businesses, missing or weak email authentication is one of the most common critical findings:
- →No DMARC record — anyone can spoof `you@yourbusiness.com`
- →DMARC at `p=none` — you get reports, but spoofed mail still lands
- →SPF too loose — `+all` or overly broad includes that make spoofing trivial
- →DKIM unsigned — legitimate mail and forged mail look the same to filters
None of this requires hacking your server. It is public DNS. Attackers automate it.
What “good” looks like (plain English)
1. SPF — a short list of services allowed to send as your domain (Microsoft 365, Google Workspace, your ESP) 2. DKIM — cryptographic signatures so receivers can verify the message was really sent by those services 3. DMARC — a policy that says: if SPF/DKIM fail alignment, quarantine or reject the message — and send you aggregate reports so you can see who is trying
Start carefully (`p=none` with reporting), fix legitimate senders, then move to `quarantine` and `reject`. That sequence is the difference between “we have a record” and “spoofed invoices bounce.”
Why this hits trades and professional offices first
Phoenix metro attackers prefer businesses that move money over email: contractors, title and realty teams, clinics, and firms that pay vendors by invoice. One successful redirect can wipe a week of revenue. The fix is usually measured in hours of DNS work — not a new product stack.
We cover this on every Phoenix cybersecurity engagement and on free external health checks across Scottsdale, Tempe, Chandler, Mesa, and Gilbert.
How to check yourself in two minutes
1. Look up your domain’s DMARC record (many free DNS lookup tools; search for `_dmarc.yourdomain.com`) 2. If there is no TXT record, or it says `p=none` with no plan to tighten, treat email spoofing as open 3. Confirm SPF exists and does not end in `+all` 4. Ask whoever runs your email whether DKIM is enabled for your tenant
Or book a free external health check — we check email auth, website exposure, and headers using public data only, then give you one fixed quote if you want it fixed.
Bottom line
Website redesigns and new firewalls do not stop invoice spoofing. DMARC does. For most Arizona small businesses, it is the highest-ROI control you can add this month.
Ready to see your exposure? Get the free check or call (480) 788-5419.
Ready to strengthen your security posture?
Get a professional assessment tailored to your business.