Article Summary: Email spoofing happens when a scammer sends a message that appears to come from your domain, often to trick your clients or employees into paying a fake invoice or changing banking details. Three DNS records—SPF, DKIM, and DMARC—help prove that a message really came from your business and tell receiving mail servers how to handle messages that did not. The key detail is that DMARC only begins blocking spoofed messages when it is set to quarantine or reject. Many businesses leave it set to none, which provides monitoring and reports but does not stop fraudulent emails.
Your customers, suppliers, and employees trust emails that come from your business. Unfortunately, cybercriminals know that too.
If someone can send an email that appears to come from your company’s domain, they can impersonate your business to request payments, change banking details, or steal sensitive information. This type of attack, known as email spoofing, is one of the most common ways email fraud begins.
The good news is that there are three email authentication standards that make it much harder for attackers to impersonate your domain: SPF, DKIM, and DMARC.
Many businesses have some of these protections in place but are missing one critical piece. In fact, a common DMARC configuration mistake means many organizations are monitoring for spoofing without actually preventing it.
In this article, you’ll learn what SPF, DKIM, and DMARC do, how they work together to protect your domain, the most common mistake businesses make when configuring them, and how to check whether your own domain is properly protected.
Why Email Spoofing Happens
Email was created in a much more trusting era. By default, the system that delivers email doesn’t verify that the sender is really who they claim to be. The From address on an email is much like the return address written on an envelope. Anyone can write almost anything there, and the message can still be delivered.
Email spoofing takes advantage of this.
A scammer simply places your domain in the From field and sends the message. Unless your domain has been configured to prevent it, the receiving mail server has no reason to question it. The email can arrive in your client’s inbox looking as though it genuinely came from your business.
The UK’s National Cyber Security Centre publishes anti-spoofing guidance for this very reason.
The Three Email Authentication Standards That Protect Your Domain
Three DNS records work together to verify that an email really came from your domain. You publish them once through your domain registrar or DNS provider, and receiving mail servers check them every time an email is sent from your domain.
SPF: Authorizes Who Can Send Email for Your Domain
SPF is a list of the mail servers that are authorised to send email for your domain.
When a receiving mail server receives a message claiming to come from your business, it checks whether the sending server is on that list. If a server that’s not authorised tries to send email using your domain, SPF flags it.
DKIM: Verifies Your Emails Haven’t Been Altered
DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send.
Your mail server signs outgoing messages with a private key, while the matching public key is stored in your DNS. The receiving mail server checks that signature to confirm two things:
- The email genuinely came from your domain.
- The message hasn’t been altered in transit.
DMARC: Tells Email Providers What to Do When Authentication Fails
DMARC (Domain-based Message Authentication, Reporting and Conformance) brings SPF and DKIM together and tells receiving mail servers what to do when an email fails authentication.
It also confirms that the domain shown in the visible From address matches the domain verified by SPF and DKIM. That’s the part that prevents someone from forging your exact email address.
DMARC also sends reports showing who is sending email using your domain, including senders who shouldn’t be.
The DMARC Mistake That Leaves Many Businesses Unprotected
DMARC has three policy settings, and choosing the wrong one is a common mistake.
- p=none tells receiving mail servers to take no action if an email fails authentication. It simply monitors activity and sends reports. Your domain can still be spoofed.
- p=quarantine tells receiving servers to send failing messages to the junk folder.
- p=reject tells receiving servers to reject failing messages before they’re delivered.
Many businesses configure DMARC with p=none, review the reports, and never move beyond that stage.
At p=none, you receive reports, but your domain isn’t fully protected.
Real protection begins when your policy is set to quarantine or reject.
Microsofts guidance recommends working toward p=reject after you’ve confirmed that your legitimate email passes authentication.
What Email Authentication Doesn’t Protect Against
These records prevent someone from forging your exact domain.
However, there are two types of impersonation they don’t stop.
- Lookalike domains. A scammer can register a domain that closely resembles yours, such as yourcompany-invoices.com or yourcompany.co instead of yourcompany.com, and send email from that domain. Your authentication records protect your real domain, not one owned by someone else.
- Display-name spoofing. The sender name might appear as “Your Company Accounts”, while the actual email address behind it is a random Gmail account. DMARC verifies the domain, not the display name.
To protect against these types of attacks, it’s still important to check the full email address rather than relying on the display name alone. Any request to change payment details should also be verified by calling a trusted phone number rather than using contact details included in the email.
Why Every Business Should Use SPF, DKIM, and DMARC
There are two important reasons to configure these records.
The first is protection.
They help prevent cybercriminals from impersonating your domain when emailing your clients, suppliers, or employees.
The second is email deliverability.
Major email providers now expect these records from organizations that send large volumes of email.
Since February 2024, Google and Yahoo have required bulk senders—those sending more than 5,000 emails per day—to use SPF, DKIM, and DMARC.
Microsoft introduced similar requirements for Outlook.com and Hotmail in 2025, first sending non-compliant high-volume email to junk folders and later rejecting it.
Even if you send far fewer emails than these thresholds, properly authenticated domains are generally more likely to reach the inbox than the spam folder.
How to Check If Your Domain Is Protected
You can get a general idea of your email authentication by using one of the many free SPF and DMARC checking tools available online.
Simply enter your domain to see whether these records exist. While this won’t confirm that everything has been configured correctly, it will tell you whether the records are present.
Correctly configuring these records is usually a task for your IT provider or whoever manages your domain and email. Because these records are stored in your DNS, an incorrect configuration can cause legitimate email to be treated as spam.
The safest approach is to roll them out in stages:
- Publish SPF and DKIM so all legitimate email sources are covered.
- Add DMARC with p=none and review the reports to confirm legitimate email passes authentication.
- Move DMARC to p=quarantine, and then p=reject, once you’re confident everything is working correctly.
Microsoft recommends following this same phased approach so you can protect your domain without disrupting legitimate email delivery.
Conclusion
Email spoofing is preventable, but only if your domain is properly configured.
SPF, DKIM, and DMARC work together to help protect your business from impersonation, improve the delivery of legitimate email, and reduce the risk of fraudulent messages reaching your clients or employees. Simply having these records isn’t always enough—it’s equally important that they’re configured correctly.
If you’re unsure whether your domain is properly protected, contact our team. We can review your email authentication settings, identify gaps, and help you implement SPF, DKIM, and DMARC correctly so your business can send email with greater confidence and security.
Frequently Asked Questions
What is email spoofing?
Email spoofing is when someone sends an email using your domain in the From address to make it appear that the message came from your business. It’s commonly used to trick clients, suppliers, or employees into paying fake invoices, changing banking details, or sharing sensitive information.
What are SPF, DKIM, and DMARC in simple terms?
SPF is a list of the servers that are allowed to send email for your domain.
DKIM is a digital signature that confirms an email came from your domain and hasn’t been altered.
DMARC brings the two together, tells receiving mail servers how to handle messages that fail authentication, and provides reports showing who is sending email using your domain.
Does DMARC stop all email impersonation?
No.
DMARC prevents someone from forging your exact domain. It doesn’t stop lookalike domains, such as yourcompany-invoices.com, or display-name spoofing, where the sender name appears to be your business but the email address is different.
These threats still require employee awareness and processes such as verifying payment changes before acting on them.
Will setting up DMARC block my own emails?
Not if it’s implemented gradually.
Starting with p=none allows you to review authentication reports and confirm that legitimate email is working correctly before moving to quarantine and eventually reject.
Problems usually occur when organisations move directly to reject without first validating their legitimate email sources.
Do I need these records if I don’t send many emails?
Yes.
These records help protect your domain from being spoofed regardless of how much email you send, and they also improve the likelihood that your legitimate email reaches recipients’ inboxes.
Google, Yahoo, and Microsoft now expect proper email authentication, and messages sent without it are more likely to be filtered.
Love This Article? Share It!
Employee offboarding is a critical step in protecting your business from security risks, data loss, and compliance issues. Learn how to build a process that fully secures your systems when employees leave.
Proactive IT monitoring helps small businesses prevent downtime by identifying issues before they impact daily operations. With continuous system oversight and real-time alerts, businesses can reduce disruptions, control costs, and keep work running smoothly.
Many Issaquah business owners don’t realize the true cost of a reactive IT provider until downtime, security gaps, or missed opportunities start adding up. This guide breaks down the warning signs of a weak IT partner and how proactive IT can protect your business, reduce risk, and support long-term growth.
AI voice cloning scams are rapidly becoming a new form of business fraud. Learn how deepfake voice attacks work and the verification steps organizations should implement to stay protected.
Small businesses can use AI to automate everyday tasks like customer support, scheduling, marketing, and accounting, saving time and improving efficiency. Discover practical AI tools and strategies that help small businesses streamline operations and grow without adding staff.
AI can transform how teams work, but using it without the right safeguards can put sensitive business data at risk. Discover six practical ways organizations can safely adopt AI while protecting the information that matters most.
Remote work introduces real cybersecurity challenges, from insecure home networks to credential theft. This guide explains the essential security controls modern businesses need to protect sensitive data while enabling flexible work.
Vendor risk is a growing cybersecurity threat, often hiding beyond your firewall in the third-party tools and partners you trust. Learn how vendor vulnerabilities impact security, operations, and compliance, and how you stay protected and in control.
Quarterly Business Reviews (QBRs) help ensure your technology strategy stays aligned with your business goals, moving the conversation beyond daily support to focus on growth, risk reduction, and long-term planning.
A data breach is one of the most urgent challenges an organization can face, and the first steps you take can shape the entire outcome. This guide outlines seven immediate actions to contain damage, restore operations safely, and rebuild trust.
STAY IN THE LOOP
Subscribe to our free newsletter.
