Quick check: Is DMARC set to p=reject on your clients' domains? If it's p=none, it's only monitoring—not actually blocking spoofed emails.

#DMARC #EmailAuth #Spoofing
https://365securityassessment.com