ProtectIndiana.org East Central Region Impersonation Task Force We check who can be faked.

of the businesses in this region can be impersonated by anyone. Today. Without hacking anything.

75% of the businesses in this region can be impersonated by anyone, today, without hacking anything.

I am Erin Porter, Senior Prevention Agent. I audited 834 businesses here. 624 are open.

Read the audit iPhone & iPadComing to the App Store
Henry 89/118 Delaware 274/371 Madison 235/312 Wayne 26/33 377 with no protection at all

The agent

Hi. I'm Erin.

I'm a Senior Prevention Agent with ProtectIndiana.org, and East Central Indiana is my region: Henry, Delaware, Madison, and Wayne counties. My job is stopping scams before they start, which sounds like a film and is mostly a spreadsheet. In practice it means checking the things nobody else was ever assigned to check.

This year I checked something big. I audited the public email configuration of 834 businesses across the region. Not their networks, not their computers, not their inboxes. Just the public rules attached to their domain names, the ones that tell the world's mail servers what to trust. If a letter or an email from me sent you here, this page is the long version.

Here is the finding, plainly. 624 of those 834 businesses can be impersonated by email right now. Anyone can send a message wearing their name and their domain, and nothing in the mail system will stop it. Today. Without hacking anything.

The task force

Nobody sent us

The Impersonation Task Force is an internal operation of ProtectIndiana.org. We named it ourselves. No agency deputized us, no statute empowers us, and no business is under any obligation to answer when I write. We are not law enforcement, and we do not pretend to be. I want that on the record first, because everything on this page depends on you trusting the work, not the letterhead.

So why does not a government office keep a task force? Because the question at the center of most email scams has an exact answer. Whether a business can be impersonated is not a matter of opinion. It is written in public DNS records, readable by anyone on earth. Scammers read those records. Almost nobody else does. So I sat down and read them too, business by business, across four counties, and wrote down what I found.

The method is deliberately boring. Four public record lookups per business: MX, SPF, DKIM, DMARC. One ordinary visit to the public website, the same visit any customer makes. Nothing accessed, nothing logged into, no vulnerability touched. And when a business turns up exposed, it gets its exact fix in writing, free, whether it ever pays us or not. That is the entire operation. It holds up because every step is checkable, not because anyone gave us a badge.

Trust the work, not the letterhead.

Current sweep834 businesses audited across 4 counties. 624 are open to impersonation today. 377 publish no DMARC at all.

The procedure

How I know (I didn't hack anybody)

Fair question. Every domain on the internet publishes a short set of public records, called DNS, which stands for something you will never need to say out loud. What the records do is the part that matters: they tell the world's mail servers how to treat a domain's email. Where to deliver it, who may send it, what to do with fakes. Reading them is not hacking. It is the same lookup Gmail runs every time someone emails you, finished in milliseconds.

I ran that lookup, on purpose, for 834 domains, and wrote down what came back. I also visited each business's public website the way any customer would, to confirm who the domain belongs to. That is the entire method. Nothing was accessed, nothing was logged into, no mail was read, and no vulnerability was exploited. It is about as intrusive as reading the number on the front of a building. Anyone with a laptop could run the same checks tonight; I am just the one who did.

One more thing before the numbers, because it matters. None of this means your email account is compromised. Your mailbox, your password, and your computers are not part of this story. The problem is that your domain's public rules never told the internet who is allowed to send as you, and when the rules say nothing, the internet fills in the blank with: anyone.

377

of them publish no protection whatsoever. Not weak protection. None.

The count

What I found

Of the 834 businesses I checked, 624 can be impersonated as of the day I checked them. 377 of the 834 have no DMARC record at all. DMARC is short for something nobody has ever said out loud, so here is what it actually does: it tells a receiving mail server what to do with a fake. No record means no instruction, and no instruction means the fake gets delivered wearing your name.

If you are wondering whether you were singled out, you were not. Three out of four businesses in this region are in the same position: the restaurant down the street, the dentist, the church, probably several of my neighbors. Around here, spoofable is normal, and normal is the problem. A scammer does not have to hunt for the rare unlocked door when most of the doors are unlocked.

What does an open door get used for? Fake invoices sent to your customers, from you. A note to your bookkeeper, from you, asking to update a vendor's bank account. None of it takes technical genius. These scams run on one thing, the From line looking right, and when your domain publishes no rules, the From line always looks right.

89

Henry County

of 118 audited · 75%

274

Delaware County

of 371 audited · 74%

235

Madison County

of 312 audited · 75%

26

Wayne County

of 33 audited · 79%

Delaware County holds the biggest share because it holds the most businesses: 274 of the 371 I checked there can be impersonated. Madison follows at 235 of 312, Henry sits at 89 of 118, Wayne at 26 of 33. Run the percentages and every county lands in the same unhappy neighborhood. This is not a Muncie problem or a New Castle problem. It is an everywhere problem, and an everywhere problem is what you get when the job belongs to nobody. So I assigned it to myself.

By trade

Who this touches

It cuts across every kind of livelihood the region has. Restaurants, retail, and hospitality lead: 69 exposed out of the 89 I checked. Healthcare and dental practices sit at 39 exposed of 53, which is the line on this table I like least, because patients tend to do what an email from their provider tells them. Construction and trades, churches and nonprofits, clubs, home services, professional services, real estate: all present. The reachable column counts the exposed businesses that publish an email address I can actually write to; the rest are harder to warn.

  1. Restaurants, retail & hospitality 89 supplier & payroll fraud · 69 with nothing at all
  2. Healthcare & dental 53 patient trust · 39 with nothing at all
  3. Construction & trades 44 invoice fraud · 24 with nothing at all
  4. Churches & nonprofits 32 donor & member fraud · 16 with nothing at all
  5. Home & property services 28 invoice fraud · 17 with nothing at all
  6. Clubs, sport & recreation 26 member & fundraiser fraud · 19 with nothing at all
  7. Real estate & property 22 deposit diversion · 12 with nothing at all
  8. Professional & business services 21 client-billing fraud · 9 with nothing at all
  9. Schools & childcare 14 parent fraud · 5 with nothing at all
  10. Banks & credit unions 11 member impersonation · 6 with nothing at all
  11. Law firms 10 client-funds fraud · 6 with nothing at all
  12. Funeral homes & cemeteries 10 pre-need fund fraud · 9 with nothing at all

Three patterns

Three shapes of exposed

Exposure is not one problem. Among the 624, most of it comes in three shapes, and the right fix depends on which shape is yours.

160

Google Workspace, set up in-house

160 of the exposed businesses run Google Workspace they set up themselves. Mail started flowing, the setup wizard stopped asking questions, and the last step, the one that actually locks the door, never happened. Nothing here is broken; it is unfinished.

181

Microsoft 365 or a managed filter

181 exposed businesses run Microsoft 365 or a managed mail filter, which means an IT provider is already in the picture. This is not a skills gap; it is a nobody-asked gap. Forward this page to your provider and ask one question: is our DMARC at enforcement? That is genuinely how it is phrased. It means: does the lock lock.

130

No mail service at all

130 exposed domains have no mail service whatsoever, which sounds like the safest arrangement possible and is the opposite. Anyone can forge mail from them, and the owner never finds out, because nothing ever bounces back to a mailbox that does not exist. A few lines of DNS close these for good.

The fix

The fix is smaller than the problem

The fix is three public records published in your domain's DNS: SPF, DKIM, and DMARC. Three acronyms, none of which you will ever need to expand. SPF is the list of servers allowed to send as you. DKIM puts a tamper-evident seal on your real mail. DMARC tells every receiving mail server on earth to reject whatever fails the other two, and to send you a report about it. None of this touches your computers or changes how you read email.

If you are bracing for an invoice with a comma in it, don't. For most businesses this is about ten minutes of work for whoever manages your domain, and the records themselves are a few lines of text. Configuration, not construction.

Here is our policy, stated plainly: ProtectIndiana.org will send you the exact records for your setup, free, whether or not you ever pay us for anything. That is deliberate. A security outfit that only protects the people who pay it is not a security outfit; it is a toll booth. Some businesses will want the work done for them, the reports watched, and the odd edge case handled. That part is our paid service, and it is what pays for the free part.

  1. Find out who manages your domain's DNS (usually whoever set up your website).
  2. Request your exact SPF, DKIM, and DMARC records from us. They are free whether you ever hire us or not.
  3. Have the three records published, starting DMARC in monitor-only mode so nothing legitimate gets blocked.
  4. Once the reports run clean, switch DMARC to enforcement. That is the click that locks the door.

Anticipated questions

The questions I get, in the order I get them

Did she hack us?

No. I looked up public DNS records, the same lookup every mail server on earth performs before delivering a message, and I visited your public website. Nothing was accessed and nothing was logged into.

Is our email account compromised?

No, and nothing on this page says it is. This is about your domain's public rules, not your mailbox, your password, or your computers.

Are we being singled out?

No. 624 of the 834 businesses I checked are in the same position, so you are not the weak one in the region; the region is the weak one.

This is exactly what a scam looks like.

It is, and I would worry about you if you didn't think so. So verify me: any free DMARC checker will show you the same result, the fix records are free whether you pay us or not, and nobody here will ever ask for passwords, remote access, or a deadline.

Is fixing it expensive or disruptive?

It is three DNS records. Most IT people publish them in about ten minutes, nothing about your day-to-day email changes, and I will send the exact lines for your setup at no charge.

On trusting a stranger from a security company

Let's name the elephant. A stranger from a security company appears, describes a frightening problem, and happens to sell the cure. I know exactly what that looks like, because cataloging that pattern is most of my job. So do not take my word for anything on this page. Have your IT person look up your domain, or paste it into any free DMARC checker online, and the result will match what I told you. Real problems survive verification; scams discourage it.

Notice what this page has not done. No countdown, no deadline, no request for a password or remote access, and nobody here will ever ask you for a gift card. The records are free whether we ever meet. Scammers can fake a From line; what they cannot fake is patience.

So here is the one invitation I will make. If your business is in Henry, Delaware, Madison, or Wayne County and you want to know where you stand, write to me. I will tell you exactly what your domain says to the world, and send you the records that fix it, at no charge, to use with anyone you like. If you would rather have the whole thing handled end to end, we should talk. Either way, the door gets locked.

One more number, and not a sales one. ProtectIndiana.org runs a free scam help line for Hoosiers, 24 hours a day, at 1-888-985-6187. If an email, text, or phone call ever feels wrong, call before you act. That is what it is there for.

Ask me where your domain stands

Free Hoosier scam line, any hour: 1‑888‑985‑6187

Somebody is keeping score now.

Erin PorterErin Porter · Senior Prevention Agent · ProtectIndiana.org, East Central Region. And yes, protectindiana.org publishes its own SPF and DMARC. I checked. Obviously.