Right now, with no special tools, someone could send an email that looks like it came from your company.

The From line would show your domain. Your logo could be pasted into the body. It could ask a client in Laurel or Hattiesburg to pay an invoice or update banking details. That is email spoofing — and it is one of the most common ways fraud against your clients and suppliers begins.

Three DNS settings make this much harder: SPF, DKIM, and DMARC.

Most businesses have one or two set up and the third missing or stuck on the wrong policy. That gap is usually all it takes to let a spoofed message through.

Why scammers can send email in your company’s name

Email was built in a more trusting time. The delivery system does not, on its own, prove the sender is who they claim to be. The From address is about as trustworthy as a return address handwritten on an envelope — anyone can write anything there, and the mail can still arrive.

A scammer puts your domain in the From field and sends. Unless your domain is set up to prevent it, the receiving server has little reason to question it. The message lands looking like it came from you.

The three records that stop email spoofing

You add these once at your domain registrar or DNS host. Receiving mail servers check them on every message claiming to be from you.

SPF (Sender Policy Framework)

SPF is a public list of mail servers allowed to send email for your domain. When a receiving server gets a message claiming to be from you, it checks whether the sending server is on that list. Servers that aren’t get flagged.

DKIM (DomainKeys Identified Mail)

DKIM adds a tamper-evident signature to every message you send. Your mail server signs outgoing mail with a private key; the matching public key sits in DNS. The receiver confirms the message came from your domain and wasn’t altered in transit.

DMARC (Domain-based Message Authentication, Reporting and Conformance)

DMARC ties SPF and DKIM together and tells receiving servers what to do when a message fails. It also checks that the visible From domain matches what SPF/DKIM verified — the piece that stops someone forging your exact address. It can send you reports showing who is sending as your domain, including senders who shouldn’t be.

The DMARC setting most businesses get wrong

DMARC has three policy settings:

  • p=none — do nothing on failure; monitor and report only. Your domain can still be spoofed.
  • p=quarantine — send failing messages to junk.
  • p=reject — block failing messages before they arrive.

A lot of businesses publish DMARC at p=none, watch reports, and never move past it. At none, you get visibility but not protection. Real protection starts at quarantine or reject. Microsoft’s guidance is to work toward p=reject once legitimate mail is confirmed to pass.

What SPF, DKIM, and DMARC don’t stop

These records stop forging your exact domain. They do not catch:

  • Lookalike domains — yourcompany-invoices.com or a different TLD that resembles yours.
  • Display-name spoofing — the name says “Your Company Accounts” while the real address is a random Gmail.

For those, keep the habits that catch phishing: check the full address (not just the display name), and verify any payment-detail change by calling a known number — not one from the email.

Why this matters even if you don’t send bulk email

Protection first: these records stop scammers from impersonating your domain to clients, suppliers, and staff.

Deliverability second: major mailbox providers require proper authentication for high-volume senders. Since February 2024, Google and Yahoo have required SPF, DKIM, and DMARC for bulk senders (over 5,000 messages a day). Microsoft applied similar requirements to Outlook.com/Hotmail in 2025 for non-compliant high-volume mail. Even below those thresholds, authenticated domains land in the inbox more reliably.

How to check and fix your domain

Free DMARC/SPF checkers can show whether records exist — not always whether they’re correct. Fixing them belongs with whoever manages your IT or DNS. A mistake can send your own mail to spam, so roll out in stages:

1. Publish SPF and DKIM so all real mail sources are covered.

2. Add DMARC at p=none and read reports until legitimate mail passes cleanly.

3. Move to p=quarantine, then p=reject.

Microsoft recommends that same gradual path. West Computers configures email authentication for Microsoft 365 tenants across the Pine Belt so protection doesn’t break day-to-day mail.

Frequently asked questions

What is email spoofing?
Someone sends a message with your domain in the From address to make it look like it came from your company — often to push fake invoices, bank-detail changes, or credential theft.

What are SPF, DKIM, and DMARC in simple terms?
SPF lists servers allowed to send as you. DKIM signs messages so receivers can prove origin and integrity. DMARC ties them together, sets a fail policy, and reports who is sending as your domain.

Does DMARC stop all email impersonation?
No. It stops forging your exact domain. Lookalike domains and display-name spoofing still need staff awareness and payment-verification habits.

Will setting up DMARC block my own emails?
Not if you roll out gradually — start at p=none, confirm legitimate mail passes, then move to quarantine and reject. Jumping straight to reject without checking is what causes outages.

Do I need these records if I don’t send many emails?
Yes. They protect your domain from spoofing regardless of volume, and they help mail reach the inbox. Google, Yahoo, and Microsoft all expect proper authentication.

Article adapted with permission from The Technology Press.