In this article · 6 sections
Email spoofing is when someone sends an email that appears to come from your address, such as [email protected], without ever accessing your mailbox. Scammers use it to send fake invoices, payment change requests or phishing to your customers and staff. The fix is technical but simple: properly configured SPF, DKIM and DMARC records on your domain.
Signs your domain is being spoofed
- Customers ask about emails you never sent
- You receive bounce-backs for messages you didn't send
- Your emails start landing in spam more often
The three records
| Record | What it does |
|---|---|
| SPF | Lists which servers may send email for your domain (e.g. Google, Hostinger, Zoho) |
| DKIM | Adds a digital signature that proves the message wasn't altered and came from an authorised system |
| DMARC | Tells receiving servers what to do when SPF/DKIM fail: monitor, quarantine (spam) or reject, and sends you reports |
Setup steps for each are in our business email SPF, DKIM and DMARC guide. Records are added as TXT records in DNS. See DNS records explained.
A safe DMARC rollout
- Start with monitoring:
v=DMARC1; p=none; rua=mailto:[email protected] - Read reports for 2–4 weeks; find every legitimate sender (website forms, billing software, CRM, newsletter tool)
- Add missing senders to SPF and set up DKIM for them
- Move to
p=quarantine - Finally
p=rejectonce legitimate mail passes
Jumping straight to reject can block your own invoices or website form emails.
Check your domain now
Use free online SPF/DMARC checkers. Common problems:
- No DMARC record at all
- Multiple SPF records (only one is allowed)
- SPF exceeding the 10-DNS-lookup limit
- Website contact forms sending from PHP mail() without authentication. See contact form not working
Lookalike domains
DMARC protects your exact domain only. Scammers may register yourbusiness-in.com. Watch for these and report them. See cybersquatting.
FAQs
Does DMARC stop spam to my inbox?
It mainly stops others from impersonating your domain. Your inbox still relies on spam filters.
Is this needed for small businesses?
Yes. Gmail and Yahoo now require authentication for bulk senders, and spoofing hits small firms often.
Was this article helpful?
Your answer helps us improve our guides