One of our clients got a cold call from a security firm warning that its email domain could be impersonated because its SPF and DMARC records were wrong. The client brought the warning to us. We checked the public DNS records: they were configured correctly.
Email spoofing is a real business risk. That’s why a warning like this deserves a careful check, not a rushed purchase or a stranger making changes to your domain.
Ask for the evidence
Before you pay for a scan or a fix, ask which domain and DNS record failed, what value they found, and what result they expected. Ask for the test result in writing. A legitimate finding should be specific enough for your IT provider to reproduce.
Then send the details to the person or company that manages your email and DNS. Have them verify the records through a channel you already trust. Don’t give a cold caller access to your domain account, and don’t let a surprise sales pitch rush you into a contract.
If the records are wrong, get them fixed. If the caller can’t show what they tested, get a second opinion before spending money. The point isn’t to ignore security warnings; it’s to make sure the warning is real and the fix is the right one.
Quick move: if a stranger says your email is exposed, ask for the exact record and test result, then call your current IT provider.