3 Email Settings That Stop Business Impersonation

Article Summary: Email spoofing happens when a scammer sends a message that appears to come from your domain, often to trick your clients or employees into paying a fake invoice or changing banking details. Three DNS records—SPF, DKIM, and DMARC—help prove that a message really came from your business and tell receiving mail servers how to handle messages that did not. The key detail is that DMARC only begins blocking spoofed messages when it is set to quarantine or reject. Many businesses leave it set to none, which provides monitoring and reports but does not stop fraudulent emails. 

Your customers, suppliers, and employees trust emails that come from your business. Unfortunately, cybercriminals know that too. 

If someone can send an email that appears to come from your company’s domain, they can impersonate your business to request payments, change banking details, or steal sensitive information. This type of attack, known as email spoofing, is one of the most common ways email fraud begins. 

The good news is that there are three email authentication standards that make it much harder for attackers to impersonate your domain: SPF, DKIM, and DMARC. 

Many businesses have some of these protections in place but are missing one critical piece. In fact, a common DMARC configuration mistake means many organizations are monitoring for spoofing without actually preventing it. 

In this article, you’ll learn what SPF, DKIM, and DMARC do, how they work together to protect your domain, the most common mistake businesses make when configuring them, and how to check whether your own domain is properly protected. 

Why Email Spoofing Happens 

Email was created in a much more trusting era. By default, the system that delivers email doesn’t verify that the sender is really who they claim to be. The From address on an email is much like the return address written on an envelope. Anyone can write almost anything there, and the message can still be delivered. 

Email spoofing takes advantage of this. 

A scammer simply places your domain in the From field and sends the message. Unless your domain has been configured to prevent it, the receiving mail server has no reason to question it. The email can arrive in your client’s inbox looking as though it genuinely came from your business. 

The UK’s National Cyber Security Centre publishes anti-spoofing guidance for this very reason. 

The Three Email Authentication Standards That Protect Your Domain 

Three DNS records work together to verify that an email really came from your domain. You publish them once through your domain registrar or DNS provider, and receiving mail servers check them every time an email is sent from your domain. 

SPF: Authorizes Who Can Send Email for Your Domain

SPF is a list of the mail servers that are authorised to send email for your domain. 

When a receiving mail server receives a message claiming to come from your business, it checks whether the sending server is on that list. If a server that’s not authorised tries to send email using your domain, SPF flags it. 

DKIM: Verifies Your Emails Haven’t Been Altered 

DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. 

Your mail server signs outgoing messages with a private key, while the matching public key is stored in your DNS. The receiving mail server checks that signature to confirm two things: 

• The email genuinely came from your domain. 

• The message hasn’t been altered in transit. 

DMARC: Tells Email Providers What to Do When Authentication Fails 

DMARC (Domain-based Message Authentication, Reporting and Conformance) brings SPF and DKIM together and tells receiving mail servers what to do when an email fails authentication. 

It also confirms that the domain shown in the visible From address matches the domain verified by SPF and DKIM. That’s the part that prevents someone from forging your exact email address. 

DMARC also sends reports showing who is sending email using your domain, including senders who shouldn’t be. 

The DMARC Mistake That Leaves Many Businesses Unprotected 

DMARC has three policy settings, and choosing the wrong one is a common mistake. 

1. p=none tells receiving mail servers to take no action if an email fails authentication. It simply monitors activity and sends reports. Your domain can still be spoofed.

1. p=quarantine tells receiving servers to send failing messages to the junk folder.

1. p=reject tells receiving servers to reject failing messages before they’re delivered. 

Many businesses configure DMARC with p=none, review the reports, and never move beyond that stage. 

At p=none, you receive reports, but your domain isn’t fully protected. 

Real protection begins when your policy is set to quarantine or reject.

Microsofts guidance  recommends working toward p=reject after you’ve confirmed that your legitimate email passes authentication. 

What Email Authentication Doesn’t Protect Against 

These records prevent someone from forging your exact domain. 

However, there are two types of impersonation they don’t stop. 

• Lookalike domains. A scammer can register a domain that closely resembles yours, such as yourcompany-invoices.com or yourcompany.co instead of yourcompany.com, and send email from that domain. Your authentication records protect your real domain, not one owned by someone else.

• Display-name spoofing. The sender name might appear as “Your Company Accounts”, while the actual email address behind it is a random Gmail account. DMARC verifies the domain, not the display name.

To protect against these types of attacks, it’s still important to check the full email address rather than relying on the display name alone. Any request to change payment details should also be verified by calling a trusted phone number rather than using contact details included in the email. 

Why Every Business Should Use SPF, DKIM, and DMARC 

There are two important reasons to configure these records. 

The first is protection. 

They help prevent cybercriminals from impersonating your domain when emailing your clients, suppliers, or employees. 

The second is email deliverability. 

Major email providers now expect these records from organizations that send large volumes of email. 

Since February 2024, Google and Yahoo have required bulk senders—those sending more than 5,000 emails per day—to use SPF, DKIM, and DMARC. 

Microsoft introduced similar requirements for Outlook.com and Hotmail in 2025, first sending non-compliant high-volume email to junk folders and later rejecting it. 

Even if you send far fewer emails than these thresholds, properly authenticated domains are generally more likely to reach the inbox than the spam folder. 

How to Check If Your Domain Is Protected 

You can get a general idea of your email authentication by using one of the many free SPF and DMARC checking tools available online. 

Simply enter your domain to see whether these records exist. While this won’t confirm that everything has been configured correctly, it will tell you whether the records are present. 

Correctly configuring these records is usually a task for your IT provider or whoever manages your domain and email. Because these records are stored in your DNS, an incorrect configuration can cause legitimate email to be treated as spam. 

The safest approach is to roll them out in stages: 

1. Publish SPF and DKIM so all legitimate email sources are covered.

1. Add DMARC with p=none and review the reports to confirm legitimate email passes authentication.

1. Move DMARC to p=quarantine, and then p=reject, once you’re confident everything is working correctly.

Microsoft recommends following this same phased approach so you can protect your domain without disrupting legitimate email delivery. 

Conclusion  

Email spoofing is preventable, but only if your domain is properly configured. 

SPF, DKIM, and DMARC work together to help protect your business from impersonation, improve the delivery of legitimate email, and reduce the risk of fraudulent messages reaching your clients or employees. Simply having these records isn’t always enough—it’s equally important that they’re configured correctly. 

If you’re unsure whether your domain is properly protected, contact our team. We can review your email authentication settings, identify gaps, and help you implement SPF, DKIM, and DMARC correctly so your business can send email with greater confidence and security. 

 

Frequently Asked Questions

What is email spoofing? 

Email spoofing is when someone sends an email using your domain in the From address to make it appear that the message came from your business. It’s commonly used to trick clients, suppliers, or employees into paying fake invoices, changing banking details, or sharing sensitive information. 

What are SPF, DKIM, and DMARC in simple terms? 

SPF is a list of the servers that are allowed to send email for your domain. 

DKIM is a digital signature that confirms an email came from your domain and hasn’t been altered. 

DMARC brings the two together, tells receiving mail servers how to handle messages that fail authentication, and provides reports showing who is sending email using your domain. 

Does DMARC stop all email impersonation? 

No. 

DMARC prevents someone from forging your exact domain. It doesn’t stop lookalike domains, such as yourcompany-invoices.com, or display-name spoofing, where the sender name appears to be your business but the email address is different. 

These threats still require employee awareness and processes such as verifying payment changes before acting on them. 

Will setting up DMARC block my own emails? 

Not if it’s implemented gradually.

Starting with p=none allows you to review authentication reports and confirm that legitimate email is working correctly before moving to quarantine and eventually reject.

Problems usually occur when organisations move directly to reject without first validating their legitimate email sources.

Do I need these records if I don’t send many emails?

Yes.

These records help protect your domain from being spoofed regardless of how much email you send, and they also improve the likelihood that your legitimate email reaches recipients’ inboxes.

Google, Yahoo, and Microsoft now expect proper email authentication, and messages sent without it are more likely to be filtered.