Right now, someone with no specialized tools could send an email that appears to come from your company.
The From line could display your domain. Your logo could be copied into the message. The email could ask one of your clients to pay an invoice, update banking information, or send sensitive documents.
This is called email spoofing, and it is one of the most common ways fraud involving clients, suppliers, and employees begins.
Three settings can be added to your domain to make spoofing much more difficult: SPF, DKIM, and DMARC.
Many businesses have one or two of these protections configured, while the third is missing or set up incorrectly. That single gap may be enough for a fraudulent email to reach its target.
This post explains what each setting does, the DMARC configuration many businesses get wrong, and how to check whether your own domain is protected.
Why scammers can send email in your company's name
Email was created during a more trusting era.
The system responsible for delivering email does not automatically verify that the sender is who they claim to be. The From address is about as reliable as a return address handwritten on an envelope. Anyone can write something there, and the message may still be delivered.
Email spoofing takes advantage of that weakness.
A scammer places your domain in the From field and sends the message. Unless your domain is configured to prevent impersonation, the receiving mail server may have no reason to question it.
The message can then arrive in your client’s inbox looking as though it came directly from your company.
The United Kingdom’s National Cyber Security Centre publishes anti-spoofing guidance for exactly this reason.
The three records that stop email spoofing
Three DNS records work together to prove that an email genuinely came from your domain.
These records are added through your domain registrar or DNS provider. Once configured, receiving mail servers check them whenever a message claims to come from your organization.
SPF (Sender Policy Framework)
SPF is a published list of the mail servers authorized to send email on behalf of your domain.
When a receiving server gets a message claiming to come from your company, it checks whether the sending server appears on that approved list.
If an unauthorized server attempts to send email using your domain, SPF flags the message.
DKIM (DomainKeys Identified Mail)
DKIM adds a tamper-resistant digital signature to every message your organization sends.
Your mail server signs outgoing email using a private key. The corresponding public key is published in your DNS.
The receiving mail server checks the signature to confirm two things: that the message genuinely came from your domain and that no one altered it while it was being delivered.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC connects SPF and DKIM and tells receiving mail servers what to do when a message fails authentication.
It also verifies that the domain shown in the visible From address matches the domain authenticated by SPF or DKIM. This alignment is what prevents someone from forging your exact email address.
DMARC can also send reports showing which services are sending email using your domain, including unauthorized senders that should not be doing so.
The DMARC setting most businesses get wrong
DMARC includes three policy settings, and choosing the wrong one is a common mistake.
- p=none tells receiving servers to take no action when a message fails authentication. The policy only monitors activity and sends reports. Your domain can still be spoofed.
- p=quarantine tells receiving servers to send failing messages to the recipient’s junk or spam folder.
- p=reject tells receiving servers to block failing messages before they reach the recipient.
Many businesses set DMARC to p=none, begin receiving reports, and never move to a stronger policy.
At p=none, you gain visibility, but your domain is not yet protected from spoofing.
Meaningful enforcement begins at p=quarantine or p=reject.
Microsoft recommends gradually working toward p=reject after confirming that all legitimate mail sources are properly authenticated.
What SPF, DKIM, and DMARC don't stop
These records help prevent someone from forging your exact domain.
However, there are two related threats they do not stop.
- Lookalike domains. A scammer can register a similar domain, such as yourcompany-invoices.com or yourcompany.co instead of yourcompany.com. Your SPF, DKIM, and DMARC records protect your real domain, not a separate domain the attacker owns.
- Display-name spoofing. The sender’s display name may say “Your Company Accounts,” while the actual email address is a random Gmail account. DMARC checks the domain in the email address, not the name displayed beside it.
These risks still require the same habits used to identify other phishing attempts.
Employees should check the complete email address rather than relying on the display name. Any request to change payment or banking information should be verified by calling a trusted phone number already on file, not a number included in the email.
Why this matters even if you don't send bulk email
The first reason is protection.
SPF, DKIM, and DMARC make it harder for scammers to impersonate your company when targeting clients, suppliers, and employees.
The second reason is email deliverability.
Major mailbox providers increasingly require proper email authentication from organizations that send large volumes of messages.
Since February 2024, Google and Yahoo have required bulk senders, generally those sending more than 5,000 messages per day, to use SPF, DKIM, and DMARC.
Microsoft began introducing similar requirements for Outlook.com and Hotmail in 2025. Noncompliant high-volume messages may be routed to junk folders and eventually rejected.
Even if your company sends far fewer messages, a properly authenticated domain is more likely to reach the recipient’s inbox instead of being filtered as spam.
How to check and fix your domain
You can get a basic understanding of your current protection without performing technical work.
Several free SPF and DMARC checking tools allow you to enter your domain and see which records are present.
These tools can confirm whether records exist, although they may not tell you whether every legitimate mail source is configured correctly.
Correcting the records should be handled by the person or provider responsible for your IT systems and domain.
The records are stored in DNS, and an incorrect configuration can cause legitimate company email to be sent to spam or rejected. For that reason, DMARC is normally introduced in stages:
- Publish SPF and DKIM records that include every legitimate system authorized to send email for your domain.
- Add DMARC using p=none and review the reports to confirm legitimate messages are passing authentication.
- Move the policy to p=quarantine and then to p=reject once the reports show that legitimate email is properly configured.
Microsoft recommends this same gradual approach. Beginning with monitoring and progressing toward rejection allows you to protect your domain without accidentally blocking your own email along the way.
Article used with permission from The Technology Press.