How to stop email spoofing of your domain

E-mail was designed without any check on the sender. The address in the From line is typed by whoever sends the message, exactly like the return address on a paper envelope. That is why a stranger can send “Please pay this invoice to our new bank account” from accounts@yourdomain.com without ever touching your servers. This is spoofing, and on most small-company domains it still works today.

The fix is not software on your computers. It is three records in your domain’s DNS, which tell the receiving servers how to recognise your real mail and what to do with the rest.

1. SPF: the list of servers allowed to send

SPF is a TXT record on your domain that lists the servers allowed to send mail for it:

v=spf1 include:_spf.google.com include:spf.brevo.com -all

One record per domain, no more than ten DNS lookups, and an ending that means something: -all (reject the rest) or ~all (treat the rest as suspicious). A record ending in +all allows the whole internet and is worse than none. The SPF generator writes the record from the list of services you use.

SPF alone does not stop spoofing: it checks the hidden envelope address, not the From line people read.

2. DKIM: a signature on each message

DKIM adds a cryptographic signature to every message, made with a key whose public half sits in your DNS. A receiver checks the signature and knows the message came from someone holding your key and was not changed on the way. Each sending service (Microsoft 365, Google Workspace, your newsletter tool) has its own DKIM records to publish: see the guides for Microsoft 365, Google Workspace, Brevo and Mailchimp.

3. DMARC: the rule that ties them to the From line

DMARC is what actually stops spoofing. It requires that SPF or DKIM passes for the domain shown in the From line, and tells receivers what to do when neither does:

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com

p=none only watches. p=quarantine sends forged mail to spam. p=reject refuses it. Start at none with a report address, read the reports until every real service passes, then tighten: From p=none to p=reject gives the steps. The DMARC generator writes the record.

Large mailbox providers now ask for this anyway: Gmail and Yahoo require SPF, DKIM and a DMARC record from bulk senders, and Microsoft rejects high-volume senders that lack them.

What DMARC cannot stop

• Look-alike domains. yourdomain-invoices.com or yourdornain.com (with rn for m) belong to the attacker, who can authenticate them perfectly. Watch for them: Look-alike domains.
• Display-name spoofing. “Your CEO” <ceo.name@gmail.com>: the domain is Gmail’s, and it passes. Only training and a “check the address” habit help.
• A real mailbox that was hacked. Mail sent from your own account passes every check.

Someone is spoofing you: what to do today

1. Check whether it is spoofing or a hacked account. Open one of the messages a recipient forwards you as an attachment and read its headers with the e-mail header analyzer. If it left from your provider’s servers with your DKIM signature, an account is compromised: change its password, turn on two-factor sign-in, and look for forwarding rules you did not create.
2. If it is spoofing, look at your DMARC record. No record, or p=none: that is why it is delivered. The DMARC checker shows what you publish.
3. Warn the people who received it. Customers and suppliers first, with a simple rule: “We never change bank details by e-mail.”
4. Tighten DMARC as fast as the reports allow. If you already know every service you send with, p=quarantine can go up the same week.
5. Bounce messages for mail you never sent (“Undeliverable…”) are the side effect of spoofing. They stop when receivers start rejecting the forged mail at the door.

The free SPF, DKIM and DMARC check tests all three records for your domain at once.