Most business owners assume that if an email appears to come from their company, it actually did.
Unfortunately, that’s not always true.
Without the proper protections in place, a cybercriminal can send an email that appears to come from your domain, add your logo, and request that a customer pay an invoice or update banking information. To the recipient, it can look completely legitimate.
This type of attack is called email spoofing, and it remains one of the most common ways businesses, customers, and vendors fall victim to fraud.
Fortunately, there are three technologies designed to prevent it: SPF, DKIM, and DMARC.
Many organizations have one or two configured correctly but leave the third incomplete or missing entirely. That small gap is often enough for fraudulent messages to get through.
In this article, we’ll explain what each of these protections does, why DMARC is frequently misconfigured, and how to determine whether your domain is properly protected.
Why Email Spoofing Is Still Possible
Email was created during a time when trust was assumed.
By default, the email system does not automatically verify that the person sending a message actually owns the address shown in the From field. In many ways, that field is similar to a return address written on an envelope. Anyone can write almost anything there.
Cybercriminals take advantage of this weakness.
They send messages using your company domain in the From address and, if your domain is not configured correctly, the receiving mail server may accept the message as legitimate. The result is an email landing in a customer’s inbox appearing to come directly from your business.
That is why cybersecurity organizations around the world, including the UK’s National Cyber Security Centre, strongly recommend anti spoofing protections.
The Three Records That Protect Your Domain
Three DNS records work together to verify that email sent from your domain is legitimate.
Once configured, receiving mail servers check these records every time an email is sent from your company.
SPF (Sender Policy Framework)
SPF identifies which mail servers are authorized to send email for your domain.
When a receiving mail server gets a message claiming to be from your organization, it compares the sending server against your published SPF record. If the server is not authorized, the message can be flagged or rejected.
Think of SPF as a guest list for your email system. If the sender is not on the list, it raises a red flag.
DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic signature to every outgoing email.
Your email platform signs each message with a private key, while a matching public key is published in your DNS records. Receiving servers use that public key to verify two things:
- The message genuinely came from your domain
- The content was not altered during delivery
DKIM helps establish both authenticity and integrity.
DMARC (Domain Based Message Authentication, Reporting and Conformance)
DMARC builds on SPF and DKIM.
It tells receiving mail servers what action to take when a message fails authentication checks. It also ensures that the visible From address matches the domain verified by SPF or DKIM.
This is what prevents someone from impersonating your exact business email address.
DMARC also generates reports that show who is sending email as your domain, including unauthorized senders that should not be there.
The DMARC Mistake We See Most Often
DMARC can be configured with three different policy settings:
p=none
Monitor only. The receiving server takes no action when messages fail authentication. Reports are collected, but spoofed email can still be delivered.
p=quarantine
Messages that fail authentication are typically directed to the recipient’s junk or spam folder.
p=reject
Messages that fail authentication are blocked entirely before they reach the recipient.
The most common mistake we encounter is organizations leaving DMARC set to p=none indefinitely.
While monitoring is an important first step, it does not provide protection. Your domain remains vulnerable to spoofing attacks until you move to quarantine or reject.
Microsoft and other major email providers recommend progressing toward p=reject once you have confirmed your legitimate email sources are configured properly.
What SPF, DKIM, and DMARC Cannot Stop
These technologies are extremely effective, but they are not a complete solution.
There are two common attack methods they do not fully address.
Lookalike Domains
A cybercriminal can register a domain that resembles yours.
For example:
- yourcompany.co instead of yourcompany.com
- yourcompanybilling.com
- yourcompanyinvoices.net
Because the attacker owns that domain, your SPF, DKIM, and DMARC records cannot stop them from sending email from it.
Display Name Spoofing
The sender name shown in an email can say something like:
“Your Company Accounting Department”
while the actual sender address is an unrelated Gmail account.
DMARC protects domains, not display names.
Because of this, employees should always verify the full sender address before responding to requests involving payments, banking changes, passwords, or sensitive information.
When in doubt, confirm requests using a known phone number rather than information provided in the email.
Why Every Business Should Care
Many organizations assume these protections only matter for companies sending large volumes of email.
That is not the case.
The primary reason to implement SPF, DKIM, and DMARC is to prevent criminals from impersonating your business.
These protections help safeguard:
- Customers
- Vendors
- Employees
- Business partners
There is also a deliverability benefit.
Major email providers increasingly expect domains to use proper authentication. Organizations that fail to implement these standards are more likely to see legitimate messages filtered as spam or rejected altogether.
Even if your company sends only a modest number of emails, proper authentication improves trust and inbox placement.
How to Check Your Domain
You can perform a basic assessment using one of the many free SPF, DKIM, and DMARC lookup tools available online.
These tools will tell you whether records exist and provide a general indication of how they are configured.
However, simply having the records in place does not guarantee they are correct.
Proper implementation typically requires access to your DNS settings and a clear understanding of every system that sends email on behalf of your organization.
A typical deployment follows these steps:
- Configure SPF to include all legitimate email services.
- Enable DKIM for your email platform.
- Publish a DMARC policy of p=none and review incoming reports.
- Resolve any authentication failures.
- Move to p=quarantine.
- Eventually move to p=reject once everything is validated.
This phased approach helps prevent legitimate business email from being blocked while improving domain security.
Frequently Asked Questions
What is email spoofing?
Email spoofing occurs when someone sends a message using your company’s domain in the From address to make it appear as though the email came from your organization. It is commonly used in invoice fraud, banking scams, and phishing attacks.
What do SPF, DKIM, and DMARC do?
SPF identifies which servers can send email on behalf of your domain. DKIM verifies that messages are authentic and have not been altered. DMARC ties those controls together and tells receiving servers how to handle messages that fail authentication.
Does DMARC stop all email impersonation?
No. DMARC protects your actual domain from being forged. It does not prevent criminals from using lookalike domains or display name spoofing.
Will DMARC block legitimate email?
Not when implemented correctly. Starting with a monitoring policy and gradually progressing to stricter enforcement allows you to identify and resolve issues before messages are blocked.
Do small businesses need SPF, DKIM, and DMARC?
Absolutely. These controls protect your reputation, your customers, and your employees regardless of company size. They also improve the likelihood that your legitimate emails reach the inbox instead of the spam folder.
Final Thoughts
Email remains one of the most commonly exploited business communication tools. SPF, DKIM, and DMARC are simple but powerful safeguards that make it significantly harder for criminals to impersonate your company.
If you’re unsure whether your domain is configured correctly, now is the time to check. A few DNS records can make the difference between a trusted email reaching the inbox and a cybercriminal successfully impersonating your business.