Right now, with no hacking involved at all, someone could send an email that looks exactly like it came from your business.
The From line would show your domain. Your logo could get pasted right into the message. It could ask one of your clients to pay an invoice or update their banking details — and there’d be nothing in the email itself to give it away. This is called email spoofing, and it’s one of the most common ways fraud against your clients and suppliers gets started.
There are three settings you can add to your own domain that make this a lot harder to pull off: SPF, DKIM, and DMARC. Most businesses we look at have one or two of these set up and the third missing — and that gap is usually all it takes to let a spoofed email through. Here’s what each one does, the setting most businesses get wrong, and how to check your own.
Why scammers can send email in your name
Email was built in a more trusting time. The system that delivers mail doesn’t, on its own, check that the sender is who they claim to be. The From address is about as trustworthy as the return address someone hand-writes on an envelope — anyone can write anything there, and the mail still gets delivered.
Spoofing takes advantage of exactly that. A scammer puts your domain in the From field, sends the message, and unless your domain’s set up to prevent it, the receiving mail server has no reason to question it. The message lands in your client’s inbox looking, for all the world, like it came from you. The UK’s National Cyber Security Centre publishes anti-spoofing guidance for exactly this reason.
The three records that stop it
Three DNS records work together to prove an email really came from your domain. You add them once, at your domain registrar or DNS host, and receiving mail servers check them on every message you send.
SPF (Sender Policy Framework)
SPF is a list of the mail servers allowed to send email for your domain, published as a DNS record. When a receiving server gets a message claiming to be from you, it checks whether the sending server is on that list. A server that isn’t on the list, trying to send as your domain? SPF flags it.
DKIM (DomainKeys Identified Mail)
DKIM adds a tamper-proof signature to every message you send. Your mail server signs outgoing email with a private key, and the matching public key sits in your DNS. The receiving server checks the signature to confirm two things: the message really came from your domain, and nobody altered it in transit.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC ties the other two together and tells receiving servers what to do when a message fails the check. It also confirms the domain in the visible From address actually matches what SPF and DKIM verified — the part that stops someone from forging your exact address. And it sends you reports showing who’s sending email using your domain, including the senders who shouldn’t be.
The DMARC setting most businesses get wrong
DMARC has three policy settings, and picking the wrong one is a common — and understandable — mistake.
- p=none tells receiving servers to do nothing when a message fails. It only monitors and sends you reports. Your domain can still be spoofed.
- p=quarantine tells them to send failing messages to the junk folder.
- p=reject tells them to block failing messages before they ever arrive.
A lot of businesses set up DMARC at p=none, watch the reports roll in, and never move past it. At p=none, you’re getting reports, but your domain still isn’t actually protected. Real protection only starts at quarantine or reject. Microsoft’s own guidance is to work toward p=reject once you’ve confirmed your legitimate mail is passing.
What SPF, DKIM, and DMARC don’t catch
These records stop someone from forging your exact domain. There are two things they don’t catch, and both are worth knowing about:
- Lookalike domains. A scammer can register a domain that resembles yours — yourcompany-invoices.com, or yourcompany.co instead of .com — and send from that instead. Your records protect your real domain, not a different one the attacker owns.
- Display-name spoofing. The name in the From line can read “Your Company Accounts” while the actual address behind it is a random Gmail account. DMARC checks the domain, not the display name.
For those two, you still need the same habits that catch any phishing attempt: check the full email address, not just the display name, and verify any request to change payment details by calling a known number — not one pulled from the email itself.
Why this matters even if you don’t send bulk email
Two reasons. First, protection: these records stop scammers from impersonating your domain to your clients, your suppliers, and your own staff.
Second, deliverability. The major mailbox providers now require these records from anyone sending in volume. Since February 2024, Google and Yahoo have required bulk senders — those sending more than 5,000 messages a day — to use SPF, DKIM, and DMARC. Microsoft started applying similar requirements to Outlook.com and Hotmail in 2025, routing non-compliant high-volume mail to junk and then rejecting it outright. Even well below those thresholds, a properly authenticated domain is more likely to land in the inbox than the spam folder.
How to check and fix your domain
You can get a rough read on where you stand without any technical work — several free DMARC and SPF checkers let you type in your domain and see which records exist. That tells you whether the records are present, not necessarily whether they’re configured correctly.
Fixing them properly is a job for whoever manages your IT or your domain. The records live in your DNS, and a mistake can send your own legitimate email to spam, so the rollout gets done in stages:
- Publish SPF and DKIM so every one of your real mail sources is covered.
- Add DMARC at p=none and read the reports to confirm your legitimate mail is passing.
- Move DMARC to p=quarantine, then to p=reject, once the reports look clean.
Microsoft recommends this same gradual path — start at none, work toward reject — so you protect the domain without accidentally blocking your own mail along the way.
Frequently Asked Questions
What is email spoofing?
It’s when someone sends a message with your domain in the From address to make it look like it came from your company — usually to trick your clients, suppliers, or staff into paying fake invoices, changing banking details, or handing over information.
What are SPF, DKIM, and DMARC in plain English?
SPF is a list of servers allowed to send email for your domain. DKIM is a signature that proves a message came from you and wasn’t altered. DMARC ties the two together, tells receiving servers to reject messages that fail, and reports who’s sending email as your domain.
Does DMARC stop all email impersonation?
No. It stops someone forging your exact domain. It doesn’t stop lookalike domains (like yourcompany-invoices.com) or display-name spoofing, where the sender’s name says your company but the address behind it is different. Those still need staff awareness and payment-verification habits.
Will setting up DMARC block my own emails?
Not if you roll it out gradually. Starting at p=none lets you watch the reports and confirm your legitimate mail passes before you move to quarantine and then reject. Skipping straight to reject without checking first is what causes problems.
Do I need these records if I don’t send many emails?
Yes. They protect your domain from being spoofed no matter how much email you send, and they help your own messages actually reach the inbox. Google, Yahoo, and Microsoft now expect proper authentication — mail without it is more likely to get filtered out.
Graham’s Take
This is one of those “set it and forget it” fixes that most businesses assume someone already handled. Half the time, nobody did — or it got set up years ago at “monitor only” and never finished. A quick domain check tells us exactly where you stand.
