Email spoofing: how to stop someone sending email as you

A customer gets an email from billing@yourcompany.com. It asks them to pay a new invoice into a different bank account. The address looks right, and so does the logo. But your company never sent it.

That is email spoofing, and it is one of the most common ways small businesses lose money. The customer pays, the money goes to a criminal, and your business gets the blame.

What is email spoofing, and why should a small business care?

Email spoofing is sending a message with a sender address that belongs to someone else. The part of your address after the @, such as yourcompany.com, is your domain.

The damage reaches your customers first. A forged invoice can cost a customer real money. After that, they stop trusting your emails, including the real ones.

This is not rare. In 2024, phishing and spoofing was the most reported crime in the United States, with about 193,400 complaints. Business email compromise, where a criminal takes over or fakes a business email to steal money, caused about $2.77 billion in reported losses in the same year. Both figures come from the FBI's Internet Crime Complaint Center (IC3).

Can someone really send email as my business?

Yes. The basic email rules never checked the From address. Anyone can type any address in that field, and nothing in the message stops them.

Later, the industry added checks that let the receiving server ask two questions. Did this message come from a server my domain approved? And was it signed by my domain? Those checks are SPF, DKIM and DMARC.

What are SPF, DKIM and DMARC?

SPF, DKIM and DMARC are three records in your domain's DNS. DNS is the public system that holds your domain's settings. You edit it at your domain registrar or DNS host. Each record is a short text entry called a TXT record.

• SPF (Sender Policy Framework) lists the servers allowed to send email for your domain. Your mail provider, your invoicing tool and your newsletter service each need to be on that list. SPF is defined in RFC 7208.
• DKIM (DomainKeys Identified Mail) adds a digital signature to each message. The public key lives in your DNS. If the signature checks out, a service you authorized sent the message, and nobody changed it on the way. DKIM is defined in RFC 6376.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties the two together. It tells receivers what to do when a message fails, and where to send you reports. DMARC is defined in RFC 9989.

Why do I need DMARC if I already have SPF?

SPF checks the address the message used on its way to the receiver. That address is often not the one your customer sees.

An attacker can send from their own server, pass SPF for their own domain, and still show yourcompany.com in the From line. SPF alone does not stop that. DMARC does, because it checks that the visible From address matches a domain that passed SPF or DKIM.

What do the four DMARC states mean?

Your DMARC state tells receivers what to do with mail that claims your domain and fails the checks. There are four states, from the weakest protection to the strongest.

A missing record and p=none both leave the door open. Only p=quarantine and p=reject tell receivers to act.

How do I check if someone can send email as my domain?

You can do this yourself with any DNS lookup tool, or with Ward's free check.

1. Look up the TXT record named _dmarc.yourcompany.com, using your own domain. If nothing comes back, you have no DMARC record.
2. Read the p= value. If it says none, your domain is only being watched.
3. Look up the TXT record at the root of your domain. If it starts with v=spf1 and lists your mail services, SPF is in place.

Ward's free check reads these public records from outside your company. It tells you what is missing, and it explains each finding in plain words. Here is what one finding looks like for a domain that stops at p=none.

How do I stop spoofing without blocking my own email?

Move in stages. Find your senders first, then publish DMARC in monitoring mode, read the reports, and only then tighten the policy.

1. List every service that sends email as your domain. Include your mail provider, invoicing, billing, newsletters, scheduling tools, and any website form that sends email.
2. Make sure each one passes SPF or DKIM for your domain. If a service signs with its own domain, ask it to sign with yours.
3. Publish DMARC at p=none, with a reporting address. This does not change how your mail is delivered. It starts the reports.
4. Read the reports for several weeks. Fix each legitimate sender that fails.
5. Move to p=quarantine, then to p=reject. Raise the percentage in steps, and keep reading the reports.

The step-by-step setup for Microsoft 365 and Google Workspace is in DMARC setup: a step-by-step guide for small businesses. Microsoft's own guide describes the same gradual rollout in its DMARC setup article.

Does DMARC stop every fake email?

No. DMARC protects your exact domain name. It does not cover a different domain. A criminal who registers a lookalike, such as yourc0mpany.com, and sends from it is outside your DMARC check. That is a separate problem, covered in Lookalike domains: what they are and how to take them down.

Still, most spoofing uses your real name, so DMARC is the first thing to fix.

What should I do if a fake email has already gone out?

Tell the customer first. Call them on a number you already had on file, not a number in the fake email. Say that the message did not come from you and that your payment details have not changed. Do not reply to the fake email, because a reply can confirm to the sender that the address is active.

Then work out what happened. A spoofed message is one where someone only forged your address. A taken-over mailbox sends from your real account, and the proof is in your sent folder. If the sent folder is clean, the mailbox is probably fine, but change its password and turn on multi-factor sign-in anyway.

Keep a copy of the fake message, with its full headers, for your records. If money has already moved, call your bank right away and ask them to try to recall it. You can also report the message to the FBI's Internet Crime Complaint Center at ic3.gov.

What should I do this week?

• Look up your _dmarc record today. If it is missing, you have the most urgent fix.
• If it is missing, publish p=none with a reporting address, and make sure someone reads that mailbox.
• Check that your invoicing and billing tools are on your SPF record or sign with DKIM for your domain.
• Tell your team that bank details never change by email alone. Confirm any change by calling a number you already had on file.

Once your records are in place, read why your emails go to spam to make sure the mail you send is also getting through.