How to stop scammers from sending emails in your company's name

When a scammer sends an email that appears to come from your domain, often to trick your clients or staff into paying a fake invoice or changing banking details. This is known as email spoofing.

Three DNS records (SPF, DKIM, and DMARC) verify that a message was sent by you and tell receiving mail servers to reject message that didn't. The catch is that DMARC only protects you once it's set to "quarantine" or "reject," and a lot of businesses leave it on "none," which monitors but does not block.

Right now, with no special tools, someone could send an email that looks like it came from your company.

The "From" line would show your domain, your logo could be pasted into the message and it could ask one of your clients to pay an invoice or update banking details. Email spoofing is a common way fraud against your clients and suppliers can start.

There are three settings you can add to your domain that make this much harder for scammers. They're called SPF, DKIM, and DMARC. Most businesses have one or two of them set up and often the third is missing. That's usually all it takes to let a spoofed email through.

This article explains the role of these settings, the setting most businesses get wrong and how to check your own domain.

Why scammers can send email in your company's name

Email was built in a more trusting time.

The system delivering your emails does not, on its own, check the sender is who they claim to be. The "From" address on an email is about as trustworthy as the return address handwritten on an envelope. Anyone can write anything there and the mail still gets delivered.

This is where spoofing take advantage of that.

A scammer puts your domain in the "From" field, sends the message and unless your domain is set up to prevent it, the receiving mail server has no reason to question it. The message lands in your client's inbox looking like it came from you. The Australian Signals Directorate (ASD) publishes anti-spoofing guidance for exactly this reason.

Three records that stop email spoofing

Three DNS records work together to verify an email came from your domain. You add them once, at your domain registrar or DNS host and receiving mail servers check them on every message you send.

1. Sender Policy Framework (SPF)

SPF is a list of the mail servers allowed to send email for your domain, published as a DNS record. When a server receives a message claiming to be from you, it checks whether the sending server is on that list. If a server isn't on the list tries to send as your domain, SPF flags it.

2. DomainKeys Identified Mail (DKIM)

DKIM adds a tamper-proof signature to every message you send. Your mail server signs outgoing email with a private key and the matching public key sits in your DNS. The receiving server checks the signature to confirm two things:

- the message really came from your domain

- nobody altered it along the way.

3. Domain-based Message Authentication, Reporting and Conformance (DMARC)

DMARC ties the other two together and tells receiving servers what to do when a message fails the check. It also confirms the domain in the visible "From" address matches the domain SPF and DKIM verified, which is how to stop your email address from being forged.

And it sends you reports outlining everyone who is sending emails using your domain.

The DMARC setting most businesses get wrong

DMARC has three policy settings, and choosing the wrong one is a common mistake.

1. p=none tells receiving servers to do nothing when a message fails. It only monitors and sends you reports. Your domain can still be spoofed.

2. p=quarantine tells them to send failing messages to the junk folder.

3. p=reject tells them to block failing messages before they ever arrive.

A lot of businesses set up DMARC at p=none, watch the reports come in and never move past it. At p=none, you get reports but your domain still isn't protected.

Real protection only starts at quarantine or reject.

Microsoft's guidance is to work toward p=reject once you've confirmed your legitimate mail passes.

What SPF, DKIM, and DMARC don't stop

These records stop someone from forging your exact domain. There are two things they don't catch, though, and both are worth knowing about.

• Lookalike domains. A scammer can register a domain that resembles yours, like yourcompany-invoices.com, or yourcompany.co instead of .com, and send from that. Your records protect your real domain, not a different one the attacker owns.

• Display-name spoofing. The name shown in the "From" line can read "Your Company Accounts" while the real address behind it is a random Gmail account. DMARC checks the domain, not the display name.

For lookalikes and display-name spoofing, you still need regular checks to catch any phishing attempt:

- check the full email address rather than just the display name

- verify any request to change payment details by calling a known number, not one from the email.

Why this matters even if you don't send bulk email

The first reason is protection.

These records stop scammers from impersonating your domain to your clients, your suppliers and your own staff.

The second is deliverability.

The major mailbox providers now require these records from anyone sending in volume. Since February 2024, Google and Yahoo have required bulk senders, meaning those sending more than 5,000 messages a day, to use SPF, DKIM, and DMARC.

Microsoft began applying similar requirements to Outlook.com and Hotmail in 2025, routing non-compliant high-volume mail to junk and then rejecting it.

Even below those thresholds, a domain with proper authentication is more likely to reach the inbox than the spam folder.

How to check and fix your domain

You can get a rough sense of where you stand without any technical work.

Free DMARC and SPF checkers allow you to enter your domain, check which records exist and determine a threat level for your domain. If changes are required due to a high or medium threat level, these changes should be completed by your IT or domain manager.

These records live in your DNS and any errors during updates could send your legitimate emails to spam, therefore updates are completed in stages and only by an IT professional.

Frequently Asked Questions

What is email spoofing?

Email spoofing is when an email is sent with your domain in the "From" address so it appears to come from your company. It's used to trick your clients, suppliers and staff into paying fake invoices, changing banking details or handing over confidential information.

What are SPF, DKIM, and DMARC in simple terms?

SPF is a list of servers allowed to send email for your domain.

DKIM is a signature that proves a message came from you and wasn't altered.

DMARC ties the two together, tells receiving servers to reject messages that fail and reports who is sending email as your domain.

Does DMARC stop all email impersonation?

No. DMARC stops someone forging your exact domain. It does not stop lookalike domains (eg. yourcompany-invoices.com) or display-name spoofing, where the sender's name displays your company but the address behind it is different. These email impersonations require manual checking.

Will setting up DMARC block my own emails?

Not if you roll it out gradually. Starting at p=none lets you view reports and confirm your legitimate mail passes before you move to quarantine and then reject. Skipping straight to reject without checking first will cause problems with delivery of your legitimate emails.

Do I need these records if I don't send many emails?

Yes. They protect your domain from being spoofed regardless of how much email you send and they help your messages reach the correct inbox. Google, Yahoo and Microsoft now expect authentication and mail without it is likely to be filtered.

Protect Your Business from Email Impersonation

Email spoofing can damage your reputation, put your clients at risk and result in costly fraud. The good news is that protecting your domain is often a matter of correctly configuring security settings that many businesses already have access to.

Pact IT Solutions can review your email security, assess your SPF, DKIM and DMARC configuration and help ensure your domain is properly protected against spoofing attempts.

If you're unsure whether your email security settings are working as they should, contact Pact IT Solutions today.

Article used with permission from The Technology Press.