Yes, by default they can. The "From:" field in an email is just text the sender types. Nothing stops a stranger from putting you@yourdomain.com in it. What stops that mail from being delivered is a set of DNS records that let the receiver verify the sender is actually you. If those records are missing or weak, spoofed mail from your domain lands in inboxes, and the damage lands on your domain's reputation, not the spoofers'. Here's how to find out where you stand.
Check for a TXT record on your domain that starts with v=spf1. If there's no SPF record, any server on the internet can send mail as your domain and most receivers will still deliver it. If the record ends in ~all (soft fail), spoofed mail is delivered but marked. If it ends in -all (hard fail), receivers are told to reject mail from IPs that aren't on your list. No SPF, or a soft-fail SPF, is the single most common spoofing gap.
Check for a TXT record at selector._domainkey.yourdomain.com (your email provider tells you the selector). If your provider sends mail for you but there's no DKIM public key published, your legitimate mail has no signature, and a forger's mail has nothing to fail against. This one's easy to miss after a provider switch: the key that used to be there is gone, and nothing breaks loudly.
Check for a TXT record at _dmarc.yourdomain.com. This is the one that tells receivers what to do with mail that fails the first two checks, and it's the one that starts the report stream. No DMARC record means two things: spoofed mail has no policy standing in its way, and you have zero visibility into who is sending as your domain. Most domains that get reported for spoofing turn out to have had no DMARC for years, which is why nobody knew until the damage was done.
If any of the three lookups comes back empty or weak, the fix is the same order every time: get SPF in place (and end it in -all), confirm your DKIM key is published, then publish DMARC at p=none and read the aggregate reports for a week or two. The reports show you exactly who is sending as your domain. Once you've confirmed the senders you expect all pass, move to p=quarantine and then p=reject. The details and the exact record syntax are in our SPF/DKIM/DMARC guide and DMARC guide.
One thing to avoid: don't jump straight to p=reject on a domain you've never monitored. If any legitimate sender (a marketing tool, a legacy system, a forwarding setup) is misconfigured, a strict policy rejects your own mail, and that's usually how a domain ends up on a blocklist by accident.
Related: What is DMARC? · p=none vs quarantine vs reject · Why email misses Gmail's inbox
The free audit runs SPF, DKIM, DMARC, MX, TLS, PTR and IP reputation in about 30 seconds, and shows the exact record to add if one is missing.
Run the free auditWant this checked automatically every day? Inboxproof Pro monitors your domain around the clock and alerts you the moment a record breaks or an IP gets listed. See pricing →