How to Prevent Email Spoofing: Protect Your Domain Today
Email spoofing is the #1 cause of business email compromise. Learn how SPF, DKIM, and DMARC work together to prevent attackers from impersonating your domain.
Email spoofing is when an attacker sends email that appears to come from your domain. It is the foundation of most business email compromise (BEC) attacks, invoice fraud, and phishing campaigns. The good news: three free DNS records can prevent it.
How Email Spoofing Works
Email protocols were designed in an era of trust. SMTP does not inherently verify that the sender is who they claim to be. An attacker can connect to any mail server and send an email with `From: ceo@yourcompany.com`. Without authentication, receiving servers have no way to know it is fake.
The Three-Layer Defense
SPF: Who Can Send
SPF lists the IP addresses and hostnames authorized to send email for your domain. Receiving servers check the SPF record to verify the sending server is authorized. Without SPF, your domain is an open invitation for spoofing.
DKIM: Is the Email Authentic
DKIM adds a digital signature to each outgoing email. Receiving servers verify the signature against a public key published in your DNS. This proves the email was not modified in transit and genuinely came from an authorized sender.
DMARC: What to Do About Failures
DMARC tells receiving servers what to do when SPF or DKIM checks fail: nothing (p=none), quarantine to spam (p=quarantine), or reject entirely (p=reject). DMARC also provides reporting so you can monitor who is sending email from your domain.
Common Mistakes
- Setting up SPF but forgetting DKIM - Using DMARC p=none indefinitely without ever tightening - Forgetting to include all legitimate email sources in SPF (newsletters, CRMs, support tools) - Not monitoring DMARC reports
Quick Start
1. Check your current setup with our free email security tools 2. Create an SPF record listing your authorized senders 3. Enable DKIM signing in your email provider 4. Add a DMARC record starting with p=none 5. Monitor reports and tighten your policy
Protecting your domain from email spoofing takes about 30 minutes and costs nothing. The alternative—a successful BEC attack—can cost your business tens of thousands.