Article Summary: Email spoofing happens when a scammer sends a message that appears to come from your domain, often to trick your clients or employees into paying a fake invoice or changing banking details. Three DNS records—SPF, DKIM, and DMARC—help prove that a message really came from your business and tell receiving mail servers how to handle messages that did not. The key detail is that DMARC only begins blocking spoofed messages when it is set to quarantine or reject. Many businesses leave it set to none, which provides monitoring and reports but does not stop fraudulent emails.
Your customers, suppliers, and employees trust emails that come from your business. Unfortunately, cybercriminals know that too.
If someone can send an email that appears to come from your company’s domain, they can impersonate your business to request payments, change banking details, or steal sensitive information. This type of attack, known as email spoofing, is one of the most common ways email fraud begins.
The good news is that there are three email authentication standards that make it much harder for attackers to impersonate your domain: SPF, DKIM, and DMARC.
Many businesses have some of these protections in place but are missing one critical piece. In fact, a common DMARC configuration mistake means many organizations are monitoring for spoofing without actually preventing it.
In this article, you’ll learn what SPF, DKIM, and DMARC do, how they work together to protect your domain, the most common mistake businesses make when configuring them, and how to check whether your own domain is properly protected.
Why Email Spoofing Happens
Email was created in a much more trusting era. By default, the system that delivers email doesn’t verify that the sender is really who they claim to be. The From address on an email is much like the return address written on an envelope. Anyone can write almost anything there, and the message can still be delivered.
Email spoofing takes advantage of this.
A scammer simply places your domain in the From field and sends the message. Unless your domain has been configured to prevent it, the receiving mail server has no reason to question it. The email can arrive in your client’s inbox looking as though it genuinely came from your business.
The UK’s National Cyber Security Centre publishes anti-spoofing guidance for this very reason.
The Three Email Authentication Standards That Protect Your Domain
Three DNS records work together to verify that an email really came from your domain. You publish them once through your domain registrar or DNS provider, and receiving mail servers check them every time an email is sent from your domain.
SPF: Authorizes Who Can Send Email for Your Domain
SPF is a list of the mail servers that are authorised to send email for your domain.
When a receiving mail server receives a message claiming to come from your business, it checks whether the sending server is on that list. If a server that’s not authorised tries to send email using your domain, SPF flags it.
DKIM: Verifies Your Emails Haven’t Been Altered
DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send.
Your mail server signs outgoing messages with a private key, while the matching public key is stored in your DNS. The receiving mail server checks that signature to confirm two things:
- The email genuinely came from your domain.
- The message hasn’t been altered in transit.
DMARC: Tells Email Providers What to Do When Authentication Fails
DMARC (Domain-based Message Authentication, Reporting and Conformance) brings SPF and DKIM together and tells receiving mail servers what to do when an email fails authentication.
It also confirms that the domain shown in the visible From address matches the domain verified by SPF and DKIM. That’s the part that prevents someone from forging your exact email address.
DMARC also sends reports showing who is sending email using your domain, including senders who shouldn’t be.
The DMARC Mistake That Leaves Many Businesses Unprotected
DMARC has three policy settings, and choosing the wrong one is a common mistake.
- p=none tells receiving mail servers to take no action if an email fails authentication. It simply monitors activity and sends reports. Your domain can still be spoofed.
- p=quarantine tells receiving servers to send failing messages to the junk folder.
- p=reject tells receiving servers to reject failing messages before they’re delivered.
Many businesses configure DMARC with p=none, review the reports, and never move beyond that stage.
At p=none, you receive reports, but your domain isn’t fully protected.
Real protection begins when your policy is set to quarantine or reject.
Microsofts guidance recommends working toward p=reject after you’ve confirmed that your legitimate email passes authentication.
What Email Authentication Doesn’t Protect Against
These records prevent someone from forging your exact domain.
However, there are two types of impersonation they don’t stop.
- Lookalike domains. A scammer can register a domain that closely resembles yours, such as yourcompany-invoices.com or yourcompany.co instead of yourcompany.com, and send email from that domain. Your authentication records protect your real domain, not one owned by someone else.
- Display-name spoofing. The sender name might appear as “Your Company Accounts”, while the actual email address behind it is a random Gmail account. DMARC verifies the domain, not the display name.
To protect against these types of attacks, it’s still important to check the full email address rather than relying on the display name alone. Any request to change payment details should also be verified by calling a trusted phone number rather than using contact details included in the email.
Why Every Business Should Use SPF, DKIM, and DMARC
There are two important reasons to configure these records.
The first is protection.
They help prevent cybercriminals from impersonating your domain when emailing your clients, suppliers, or employees.
The second is email deliverability.
Major email providers now expect these records from organizations that send large volumes of email.
Since February 2024, Google and Yahoo have required bulk senders—those sending more than 5,000 emails per day—to use SPF, DKIM, and DMARC.
Microsoft introduced similar requirements for Outlook.com and Hotmail in 2025, first sending non-compliant high-volume email to junk folders and later rejecting it.
Even if you send far fewer emails than these thresholds, properly authenticated domains are generally more likely to reach the inbox than the spam folder.
How to Check If Your Domain Is Protected
You can get a general idea of your email authentication by using one of the many free SPF and DMARC checking tools available online.
Simply enter your domain to see whether these records exist. While this won’t confirm that everything has been configured correctly, it will tell you whether the records are present.
Correctly configuring these records is usually a task for your IT provider or whoever manages your domain and email. Because these records are stored in your DNS, an incorrect configuration can cause legitimate email to be treated as spam.
The safest approach is to roll them out in stages:
- Publish SPF and DKIM so all legitimate email sources are covered.
- Add DMARC with p=none and review the reports to confirm legitimate email passes authentication.
- Move DMARC to p=quarantine, and then p=reject, once you’re confident everything is working correctly.
Microsoft recommends following this same phased approach so you can protect your domain without disrupting legitimate email delivery.
Conclusion
Email spoofing is preventable, but only if your domain is properly configured.
SPF, DKIM, and DMARC work together to help protect your business from impersonation, improve the delivery of legitimate email, and reduce the risk of fraudulent messages reaching your clients or employees. Simply having these records isn’t always enough—it’s equally important that they’re configured correctly.
If you’re unsure whether your domain is properly protected, contact our team. We can review your email authentication settings, identify gaps, and help you implement SPF, DKIM, and DMARC correctly so your business can send email with greater confidence and security.
Frequently Asked Questions
What is email spoofing?
Email spoofing is when someone sends an email using your domain in the From address to make it appear that the message came from your business. It’s commonly used to trick clients, suppliers, or employees into paying fake invoices, changing banking details, or sharing sensitive information.
What are SPF, DKIM, and DMARC in simple terms?
SPF is a list of the servers that are allowed to send email for your domain.
DKIM is a digital signature that confirms an email came from your domain and hasn’t been altered.
DMARC brings the two together, tells receiving mail servers how to handle messages that fail authentication, and provides reports showing who is sending email using your domain.
Does DMARC stop all email impersonation?
No.
DMARC prevents someone from forging your exact domain. It doesn’t stop lookalike domains, such as yourcompany-invoices.com, or display-name spoofing, where the sender name appears to be your business but the email address is different.
These threats still require employee awareness and processes such as verifying payment changes before acting on them.
Will setting up DMARC block my own emails?
Not if it’s implemented gradually.
Starting with p=none allows you to review authentication reports and confirm that legitimate email is working correctly before moving to quarantine and eventually reject.
Problems usually occur when organisations move directly to reject without first validating their legitimate email sources.
Do I need these records if I don’t send many emails?
Yes.
These records help protect your domain from being spoofed regardless of how much email you send, and they also improve the likelihood that your legitimate email reaches recipients’ inboxes.
Google, Yahoo, and Microsoft now expect proper email authentication, and messages sent without it are more likely to be filtered.
Love This Article? Share It!
Fake recruiter messages can look legitimate enough to catch employees off guard. Learn how LinkedIn recruitment scams work, what warning signs to watch for, and how to reduce the risk before one message turns into a bigger security problem.
Remote work gives employees flexibility, but it also creates new security risks when they connect through public Wi‑Fi or work in shared spaces. This article explains how businesses can protect data, devices, and employees with practical safeguards that support secure remote work.
Old devices can slow down work, increase security risk, and cost more to repair than they are worth. Learn seven signs that it may be time to upgrade.
Ransomware doesn’t start with encryption—it starts with access. This guide breaks down how attacks unfold and what you can do to stop them early and keep your business running.
AiTM phishing attacks do not break MFA, they work around it by stealing trusted login sessions after authentication is complete. This article explains how these attacks work, why they matter for businesses, and what steps can help reduce the risk.
Shadow AI is already inside most businesses, often through tools employees use every day without formal oversight. Learn how to identify hidden AI risks, improve visibility, and implement practical guardrails without disrupting productivity.
Many cyberattacks begin with ordinary employee behavior, not advanced hacking. Learn how personal web habits create business risk and what organizations can do to reduce exposure without disrupting productivity.
Cybercriminals are finding new ways to access accounts that go far beyond weak passwords and phishing emails. Learn seven unexpected threats putting businesses and individuals at risk, and how to better protect yourself.
AI-powered fraud is making it harder for Accounts Payable teams to detect fake invoices, phishing emails, and executive impersonation scams. Learn how stronger verification processes and smarter payment controls can help reduce financial fraud risk.
Agentic AI is changing how work gets done by moving from simple tools to systems that can act independently. Learn how to prepare your business with the right foundation for safe and effective adoption.
STAY IN THE LOOP
Subscribe to our free newsletter.
