Article Summary: Email spoofing is when a scammer sends a message that appears to come from your domain, often to trick your clients or staff into paying a fake invoice or changing banking details. Three DNS records (SPF, DKIM, and DMARC) prove that a message really came from you and tell receiving mail servers to reject the ones that didn’t. The catch is that DMARC only protects you once it’s set to “quarantine” or “reject,” and a lot of businesses leave it on “none,” which monitors but does not block.
Right now, with no special tools, someone could send an email that looks like it came from your company.
The From line would show your domain, your logo could be pasted into the message, and it could ask one of your clients to pay an invoice or update banking details. This is called email spoofing, and it is one of the most common ways fraud against your clients and suppliers begins.
There are three settings you can add to your domain that make this much harder to pull off.
They’re called SPF, DKIM, and DMARC.
Most businesses have one or two of them set up and the third missing.
That’s usually all it takes to let a spoofed email through. This post explains what each one does, the setting most businesses get wrong, and how to check your own domain.
Why scammers can send email in your company’s name
Email was built in a more trusting time.
The system that delivers mail does not, on its own, check that the sender is who they claim to be. The From address on an email is about as trustworthy as the return address handwritten on an envelope. Anyone can write anything there, and the mail still gets delivered.
Spoofing takes advantage of that.
A scammer puts your domain in the From field, sends the message, and unless your domain is set up to prevent it, the receiving mail server has no reason to question it. The message lands in your client’s inbox looking like it came from you. The UK’s National Cyber Security Centre publishes anti-spoofing guidance for exactly this reason.
The three records that stop email spoofing
Three DNS records work together to prove an email really came from your domain. You add them once, at your domain registrar or DNS host, and receiving mail servers check them on every message you send.
SPF (Sender Policy Framework)<
SPF is a list of the mail servers allowed to send email for your domain, published as a DNS record. When a receiving server gets a message claiming to be from you, it checks whether the sending server is on that list. If a server that isn’t on the list tries to send as your domain, SPF flags it.
DKIM (DomainKeys Identified Mail)
DKIM adds a tamper-proof signature to every message you send. Your mail server signs outgoing email with a private key, and the matching public key sits in your DNS. The receiving server checks the signature to confirm two things: the message really came from your domain, and nobody altered it along the way.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC ties the other two together and tells receiving servers what to do when a message fails the check. It also confirms that the domain in the visible From address matches the domain SPF and DKIM verified, which is the part that stops someone forging your exact address.
And it sends you reports showing who is sending email using your domain, including the senders who shouldn’t be.
The DMARC setting most businesses get wrong
DMARC has three policy settings, and choosing the wrong one is a common mistake.
- p=none tells receiving servers to do nothing when a message fails. It only monitors and sends you reports. Your domain can still be spoofed.
- p=quarantine tells them to send failing messages to the junk folder.
- p=reject tells them to block failing messages before they ever arrive.
A lot of businesses set up DMARC at p=none, watch the reports come in, and never move past it. At p=none, you get reports but your domain still isn’t protected.
Real protection only starts at quarantine or reject.
Microsoft’s own guidance is to work toward p=reject once you’ve confirmed your legitimate mail passes.
What SPF, DKIM, and DMARC don’t stop
These records stop someone from forging your exact domain.
There are two things they don’t catch, though, and both are worth knowing about.
- Lookalike domains. A scammer can register a domain that resembles yours, like yourcompany-invoices.com, or yourcompany.co instead of .com, and send from that. Your records protect your real domain, not a different one the attacker owns.
- Display-name spoofing. The name shown in the From line can read “Your Company Accounts” while the real address behind it is a random Gmail account. DMARC checks the domain, not the display name.
For those, you still need the habits that catch any phishing attempt: check the full email address rather than just the display name, and verify any request to change payment details by calling a known number, not one from the email.
Why this matters even if you don’t send bulk email
The first reason is protection.
These records stop scammers from impersonating your domain to your clients, your suppliers, and your own staff.
The second is deliverability.
The major mailbox providers now require these records from anyone sending in volume.
Since February 2024, Google and Yahoo have required bulk senders, meaning those sending more than 5,000 messages a day, to use SPF, DKIM, and DMARC.
Microsoft began applying similar requirements to Outlook.com and Hotmail in 2025, routing non-compliant high-volume mail to junk and then rejecting it.
Even below those thresholds, a domain with proper authentication is more likely to reach the inbox than the spam folder.
How to check and fix your domain
You can get a rough sense of where you stand without any technical work.
Several free DMARC and SPF checkers let you type in your domain and see which records exist. That tells you whether the records are present, though not whether they’re configured correctly.
Fixing them properly is a job for whoever manages your IT or your domain.
The records live in your DNS, and a mistake can send your own legitimate email to spam, so the rollout is done in stages:
- Publish SPF and DKIM so all of your real mail sources are covered.
- Add DMARC at p=none and read the reports to confirm your legitimate mail passes.
- Move DMARC to p=quarantine, then to p=reject, once the reports look clean.
Microsoft recommends this same gradual path, starting at none and working toward reject, so you protect the domain without blocking your own mail on the way.
Frequently Asked Questions
What is email spoofing?
Email spoofing is when someone sends a message with your domain in the From address to make it look like it came from your company. It’s used to trick your clients, suppliers, or staff into paying fake invoices, changing banking details, or handing over information.
What are SPF, DKIM, and DMARC in simple terms?
SPF is a list of servers allowed to send email for your domain. DKIM is a signature that proves a message came from you and wasn’t altered. DMARC ties the two together, tells receiving servers to reject messages that fail, and reports who is sending email as your domain.
Does DMARC stop all email impersonation?
No. DMARC stops someone forging your exact domain. It does not stop lookalike domains (like yourcompany-invoices.com) or display-name spoofing, where the sender’s name says your company but the address behind it is different. Those still need staff awareness and payment-verification habits.
Will setting up DMARC block my own emails?
Not if you roll it out gradually. Starting at p=none lets you watch the reports and confirm your legitimate mail passes before you move to quarantine and then reject. Skipping straight to reject without checking first is what causes problems.
Do I need these records if I don’t send many emails?
Yes. They protect your domain from being spoofed regardless of how much email you send, and they help your messages reach the inbox. Google, Yahoo, and Microsoft now expect proper authentication, and mail without it is more likely to be filtered.
—
This Article has been Republished with Permission from The Technology Press.
How Email Spoofing Puts Your Business at Risk
A scammer does not need access to your email account to send a message that looks like it came from your company.
The scammer can place your domain in the From field. They can copy your logo and email style. They can then ask a client to pay a fake invoice or send money to a new bank account.
This type of fraud is called email spoofing. It is a common starting point for fraud against clients, suppliers, and staff.
Three domain settings can make spoofing your email much harder. They are SPF, DKIM, and DMARC. These records help mail servers prove that a message came from an approved source.
Many businesses have only one or two of these records in place. Others use all three but leave DMARC in monitoring mode. These gaps may let fake messages reach an inbox.
This guide explains what each record does, why the DMARC policy matters, and how to check your domain.
Why Scammers Can Send Email in Your Company’s Name
Email was built during a more trusting time. Its basic delivery system does not prove that a sender owns the address shown in the From field.
Think of the From address like a return address written on an envelope. A person can write any address there. That does not prove the letter came from that place.
Email spoofing uses this weakness. A scammer places your domain in the visible From address and sends the message from another server. Without the right domain records, the receiving mail server may have no clear reason to reject it.
The fake email may then reach your client. It could look like a normal message from your accounts team. It may include your business name, logo, and contact details. The request may also sound routine, such as an invoice reminder or a change to banking details.
The UK National Cyber Security Centre publishes email security and anti-spoofing guidance because this risk affects real businesses and their contacts.
How SPF, DKIM, and DMARC Stop Email Spoofing
SPF, DKIM, and DMARC are records stored in your domain’s DNS. Your DNS host or domain registrar may manage these records.
Receiving mail servers check the records when they process a message from your domain. Each record has a different role. They provide the best protection when they work together.
SPF Lists Your Approved Mail Servers
SPF stands for Sender Policy Framework. It lists the mail servers that may send email for your domain.
When a server gets a message that claims to come from you, it checks your SPF record. It then compares the sending server with the approved list.
If the sending server is on the list, the message can pass the SPF check. If it is not on the list, SPF flags the message.
Your SPF record must include all valid services that send mail for your domain. This may include your main email system and any other approved mail source. A missing source can cause real email to fail the check.
DKIM Adds a Signature to Your Email
DKIM stands for DomainKeys Identified Mail. It adds a digital signature to each email you send.
Your mail server creates the signature with a private key. A matching public key appears in your DNS. The receiving server uses that public key to check the signature.
This check helps prove that an approved system sent the message. It also shows whether someone changed the signed parts of the message while it was in transit.
In simple terms, SPF checks where the email came from. DKIM checks its signature.
DMARC Connects the Checks and Sets a Policy
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It connects SPF and DKIM to the domain that people can see in the From address.
This match is important. A message might pass a technical check for one domain while showing a different domain to the person who reads it. DMARC checks that the domains align.
DMARC also tells the receiving server what to do when a message fails. The server may monitor it, place it in junk, or reject it. The action depends on the policy in your DMARC record.
DMARC can also send reports. These reports show which systems send email using your domain. They can reveal valid mail services that need attention and sources that should not be using your domain.
The DMARC Setting Many Businesses Get Wrong
Publishing a DMARC record does not always mean your domain has active protection. The policy inside that record controls what happens to failed messages.
DMARC offers three main policy settings:
- p=none asks mail servers to monitor failed messages and send reports. It does not ask them to block those messages.
- p=quarantine asks mail servers to place failed messages in the junk or spam folder.
- p=reject asks mail servers to block failed messages before they reach the inbox.
Many businesses start with p=none. That is a useful first step because it provides data without taking action against failed mail.
The problem begins when a business never changes the policy. A domain left at p=none may collect reports, but the policy does not tell mail servers to stop spoofed messages.
Active protection starts when the business moves to quarantine or reject. Microsoft advises domain owners to work toward p=reject after they confirm that valid mail passes the checks.
Moving in stages matters. If a real mail source is missing from your setup, a strict policy could affect messages that your business meant to send.
What SPF, DKIM, and DMARC Cannot Stop
These records help stop someone from forging your exact domain. They do not prevent every kind of email impersonation.
Lookalike Domains
A scammer can register a domain that looks like yours. For example, the name could include an extra word such as invoices. It could also use .co in place of .com.
Your SPF, DKIM, and DMARC records control your real domain. They cannot control another domain owned by a scammer.
Display-Name Spoofing
An email may show a familiar name such as Your Company Accounts. The real address behind that name could be an unrelated Gmail account or another outside address.
DMARC checks domains. It does not prove that a display name belongs to the person or company shown.
Staff still need simple checks for these cases. They should view the full email address instead of trusting the display name. They should also confirm any request to change payment details.
That check should use a phone number the business already knows. Staff should not rely on a phone number supplied in the email that made the request.
Why Email Authentication Matters for Small Businesses
The first reason is protection. These records make it harder for scammers to use your real domain against your clients, suppliers, or staff.
A fake invoice email can damage more than one business. Your client may lose money, and your company may need to explain why a message appeared to come from your domain.
The second reason is email delivery. Mailbox providers use email authentication when deciding how to handle incoming messages.
Since February 2024, Google and Yahoo have required bulk senders to use SPF, DKIM, and DMARC. In this case, a bulk sender sends more than 5,000 messages per day.
Microsoft began similar rules for high-volume senders to Outlook.com and Hotmail in 2025. Non-compliant high-volume mail may go to junk and may later be rejected.
Your business may send far fewer messages. The records still matter. They protect your domain no matter how much mail you send. Proper authentication can also help valid messages reach the inbox instead of the spam folder.
How to Check Your Domain
You can start with a free DMARC or SPF checker. Enter your domain to see whether the records exist.
This check gives you a rough view. It can show that a record is present, missing, or set to p=none. It may not prove that every approved mail source is covered or that the full setup is correct.
The person who manages your IT, email, or DNS should review the results. DNS mistakes can cause valid business email to fail authentication or go to spam.
How to Set Up DMARC Without Blocking Real Email
A careful rollout uses reports to find and fix gaps before a strict policy begins.
- Publish SPF and DKIM records that cover all approved mail sources.
- Add DMARC with p=none and review the reports.
- Confirm that valid email passes the checks and that the domains align.
- Move the DMARC policy to p=quarantine after the results are clean.
- Move toward p=reject once you know valid mail will continue to pass.
Microsoft recommends this gradual path. It gives you time to find valid systems that send mail for your domain. It also reduces the risk of blocking your own messages.
The key is to treat p=none as a setup stage, not the final goal. Reports are useful, but reports alone do not block spoofed email.
Email Spoofing Questions for Business Owners
What Is Email Spoofing?
Email spoofing is when someone places your domain in the From address of a message. The goal is to make the email look like it came from your company.
The sender may use the fake message to request invoice payment, change banking details, or collect private information.
What Do SPF, DKIM, and DMARC Mean in Simple Terms?
SPF lists the servers that may send email for your domain. DKIM adds a signature that a receiving server can check. DMARC connects these checks to the visible From address and sets a rule for failed messages.
Does DMARC Stop All Email Impersonation?
No. DMARC helps stop the use of your exact domain. It does not stop a scammer from using a lookalike domain or a false display name.
Could DMARC Block My Own Email?
A poor setup can affect valid mail. That is why a staged rollout starts with p=none. Reports help you find valid mail sources before you move to quarantine and reject.
Do Low-Volume Senders Need These Records?
Yes. Email authentication protects your domain even if you send only a small number of messages. It can also support better delivery to your clients and suppliers.
Move DMARC Beyond Monitoring
SPF, DKIM, and DMARC form a strong base for email security. SPF approves mail servers. DKIM signs messages. DMARC checks alignment and tells receiving servers how to treat failures.
Check whether all three records are present. Then look at the policy in your DMARC record. If it says p=none, your reports may be working, but failed messages are not being blocked by that policy.
Review every valid mail source, fix any gaps, and move through quarantine toward reject. This process helps protect your domain while keeping real business email flowing.
Overwhelmed? Contact us to get help securing your company’s email.
