- Attackers can send email that appears to come from your own domain — no hacking required.
- Here is how spoofing works and the exact DNS records that stop it.
Email spoofing does not require breaking into your systems at all. Standard email protocols historically let anyone put any "From" address on a message. Without the right DNS records, an attacker can send fraudulent email that looks like it came from your finance department, and your own domain's reputation absorbs the damage.
How Spoofing Damages a Business
- Customers or partners receive fraudulent invoices appearing to be from you.
- Your domain reputation degrades, causing your genuine emails to land in spam.
- Trust erosion — once a customer receives one convincing fake, they question every future email.
The Three Records That Stop It
- SPF (Sender Policy Framework): a DNS record listing which servers are authorized to send mail for your domain. Receiving servers check this and reject mail from unauthorized sources.
- DKIM (DomainKeys Identified Mail): a cryptographic signature added to outgoing mail, proving it genuinely came from your domain and was not altered in transit.
- DMARC (Domain-based Message Authentication): a policy telling receiving servers what to do when SPF or DKIM checks fail — quarantine, reject, or just monitor — plus reporting on spoofing attempts against your domain.
Getting the Policy Right
Many businesses set DMARC to "p=none" (monitor only) and never progress further, leaving the door open despite having the record in place. The real protection comes from moving to "p=quarantine" and eventually "p=reject" once you have confirmed all legitimate mail sources are properly authenticated.
Implementation Steps
- Publish an SPF record listing your actual sending sources (hosting provider, Google Workspace, marketing tools).
- Enable DKIM signing through your email provider's settings.
- Start DMARC at "p=none" to monitor reports without disruption.
- Review DMARC reports for a few weeks to confirm all legitimate mail is passing.
- Move to "p=quarantine" then "p=reject" once confident nothing legitimate will be blocked.
Frequently Asked Questions
Does this stop all phishing targeting my company?
It stops attackers from spoofing your exact domain. It does not stop lookalike domains (like yourcompany-nepal.com) — those require separate brand monitoring.
Will this affect legitimate marketing emails?
Only if those tools are not included in your SPF record and DKIM setup — which is exactly why the monitoring phase before enforcement matters.
Need help configuring SPF, DKIM and DMARC correctly? See our business email hosting or ask our team for setup help.
