Email spoofing lets cybercriminals send messages that appear to come from your business, often to trick customers into paying fake invoices or revealing sensitive information. SPF, DKIM and DMARC work together to verify your emails and prevent impersonation. However, many businesses leave DMARC in monitoring mode, which reports spoofing attempts but doesn’t stop them.

Cybercriminals don’t need to hack your email account to impersonate your business. In many cases, they can simply send an email that appears to come from your domain.

To your customers or suppliers, it can look completely genuine. The message may include your branding, your email address, and a request to pay an invoice or update bank details.

This type of attack is known as email spoofing, and it’s one of the most common starting points for business email fraud.

Fortunately, protecting your domain doesn’t require expensive software. Three email authentication standards — SPF, DKIM and DMARC — help prove that emails really come from your business and tell receiving mail servers what to do with fraudulent messages.

In this guide, we’ll explain what each one does, why DMARC is often configured incorrectly, and how to check whether your domain is properly protected.

---

Why Can Someone Pretend to Send Email From Your Business?

Email was designed decades ago, long before today’s cyber threats existed.

By default, the system doesn’t automatically verify that the sender genuinely owns the email address shown in the From field. It’s similar to writing any return address you like on a posted letter.

Without additional security measures, attackers can exploit this weakness by sending emails that appear to come from your company.

Unless your domain has the correct authentication records in place, many receiving email servers have no reliable way to distinguish a genuine email from a fake one.

The Three Email Authentication Records You Need

SPF, DKIM and DMARC each play a different role, but together they create a much stronger defence against email spoofing.

SPF (Sender Policy Framework)

SPF is a DNS record that lists which mail servers are authorised to send email on behalf of your domain.

When an email arrives, the receiving server checks whether it came from one of those approved servers.

If it didn’t, SPF raises a warning that the message may not be legitimate.

DKIM (DomainKeys Identified Mail)

DKIM adds a unique digital signature to every outgoing email.

Receiving mail servers verify that signature using a public key stored in your DNS records.

This confirms two things:

• The email genuinely came from your domain.
• The message hasn’t been altered during delivery.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC builds on SPF and DKIM by telling receiving mail servers what action to take if an email fails authentication.

It also checks that the visible From address matches the authenticated domain, making it much harder for criminals to impersonate your business.

An additional benefit is that DMARC generates reports showing who is sending email using your domain, helping you identify both legitimate services and potential abuse.

The DMARC Setting Many Businesses Never Finish Configuring

Simply adding a DMARC record isn’t enough.

DMARC supports three policy settings:

• p=none – Monitor only. Emails that fail authentication are still delivered.
• p=quarantine – Suspicious messages are usually sent to the recipient’s junk folder.
• p=reject – Failing emails are rejected before they reach the inbox.

Many organisations stop after setting p=none because they want to review the reports first.

Unfortunately, this means spoofed emails can still be delivered successfully.

Real protection only begins once your policy moves to quarantine or, ideally, reject, after confirming that your legitimate email services are configured correctly.

What SPF, DKIM and DMARC Can’t Prevent

These technologies are extremely effective, but they don’t stop every type of impersonation attack.

For example:

• Lookalike domains – An attacker could register a domain similar to yours, such as yourbusiness-support.co.uk instead of your real address.
• Display name spoofing – The sender name might show your company name while the underlying email address is completely different.

That’s why employees should always check the full sender address and verify any request to change payment details by calling a trusted phone number.

---

Why Every Business Should Use Email Authentication

Email authentication isn’t only about security.

It also improves email deliverability.

Major email providers increasingly expect domains to use SPF, DKIM and DMARC.

Proper authentication helps legitimate emails reach inboxes instead of spam folders while making it significantly harder for attackers to impersonate your business.

Whether you send hundreds of emails each day or only a few invoices each week, protecting your domain helps safeguard both your reputation and your customers.

How to Check Your Domain

Wondering if your domain is properly secured with SPF, DKIM, and DMARC records? You can quickly assess your current configuration using our Domain Checking Tool.

While these automated checks provide a fantastic starting point, it’s important to note that they might not catch nuanced configuration mistakes. If your scan highlights vulnerabilities or necessary changes, it is always safest to have your IT provider update your DNS records directly.

A standard, secure rollout typically follows this process:

• Configure SPF and DKIM for every legitimate email service your business uses.
• Enable DMARC using a p=none policy to safely monitor incoming email reports.
• Enforce stricter policies, moving to p=quarantine and finally p=reject, once you are certain all legitimate email reliably passes authentication.

Following this staged approach is the best way to fully protect your domain from spoofing, without the risk of accidentally blocking genuine business emails.

Need Expert Help Securing Your Domain?

Ready to lock down your email communications? If setting up DNS records sounds daunting, explore our comprehensive Domain Security Packages. The Novo IT team takes the guesswork out of cybersecurity, handling your SPF, DKIM, and DMARC rollout from start to finish to ensure your business stays protected without disrupting your inbox. Reach out today to get started!

Article used with permission from The Technology Press.

---