How to Stop Email Spoofing on Your Business Domain
If you need to know how to stop email spoofing, the answer is three DNS records configured in the right order: SPF, DKIM, and DMARC. When cybercriminals impersonate your business domain to trick your clients, vendors, or employees, they damage your reputation and put your business relationships at risk. You shut down exact-domain spoofing entirely by publishing these authentication records and moving to a strict enforcement policy.
Many business owners only realize there is a problem when customers complain about receiving fake invoices or strange requests that appear to come directly from the company. This scenario is common but completely preventable.
Modern email security relies on a clear framework to verify the sender. If your domain lacks these protections, receiving mail servers have no way to tell the difference between your real Microsoft 365 or Google Workspace emails and a scammer’s forgery.
Business email spoofing protection serves two purposes. it stops scammers from using your name, and it keeps your real email out of spam folders. Major providers now require authentication for incoming messages, so locking down your domain protects both your brand and your deliverability.
How Spoofing Works and Why it Happens
To understand email spoofing prevention, you first need to understand the different ways attackers impersonate businesses. Attackers spoof emails because it is an easy way to bypass basic security filters and exploit the trust your clients have in your brand. There are three main tactics, and each requires a different defensive approach.
| Type | How it Works | Does SPF/DKIM/DMARC Stop it? | What Actually Stops it |
|---|---|---|---|
| Display-name spoofing | The visible sender name is changed to match a company executive or a known vendor, but the actual sending address is an unrelated Gmail or Yahoo account | No, because your domain is never actually forged | Spam filters and employee awareness training |
| Exact-domain spoofing | The attacker forges the underlying sender address so the email appears to come exactly from your real domain | Yes, this is exactly what SPF, DKIM, and DMARC are built to stop | Publishing and enforcing SPF, DKIM, and DMARC records |
| Lookalike domain spoofing | The attacker registers a domain that is visually similar to yours, perhaps by swapping a letter or adding a hyphen, then sets up valid authentication records for that fake domain | No, your real domain’s records do not cover a different, attacker-owned domain | Defensive domain registration, advanced threat protection software, and employee training on checking sender addresses |
Which Fix Applies to You?
Look at the actual sending address on the spoofed message, not just the display name, and match what you see below.
- The From address is your exact domain. This is exact-domain spoofing. Configure SPF, DKIM, and DMARC as described in the next section.
- The From address is unrelated (a random Gmail, Yahoo, or other domain), but the display name matches your company. This is display-name spoofing. DNS records will not help here; tighten spam filters and train employees to check the actual sending address instead of the display name.
- The From address is a domain that looks like yours but is not. This is lookalike domain spoofing. Pursue defensive domain registration and keep training employees to inspect sender addresses carefully.
It is also worth separating anti-spoofing from anti-spam in your thinking. Anti-spam filters block unwanted marketing or malicious content. Anti-spoofing verifies the identity of the sender. These are two different problems and two different toolkits.
How to Stop Email Spoofing: The SPF, DKIM, and DMARC Fix Ladder
If you are asking how to stop email spoofing for your exact domain, you must follow a specific sequence of technical steps. You cannot turn on enforcement overnight without risking your own legitimate emails. Three protocols work together to form a complete email authentication framework. The table below summarizes what each one does.
| Protocol | RFC | What it Checks | Where it’s Published |
|---|---|---|---|
| SPF (Sender Policy Framework) | RFC 7208 | Authorizes specific mail servers by IP to send on behalf of your domain; checked against the MAIL FROM (envelope sender) domain | DNS TXT record |
| DKIM (DomainKeys Identified Mail) | RFC 6376 | A cryptographic signature confirming the From header and message body were not altered in transit | DNS TXT or CNAME record (public key) |
| DMARC (Domain-based Message Authentication, Reporting, and Conformance) | RFC 7489 | Ties SPF and DKIM results to the RFC5322 From address via an alignment check, then sets your enforcement policy | DNS record |
- Publish an SPF record. Add your platform’s include statements, such as those for Microsoft 365 or Google Workspace, to a DNS TXT record authorizing their servers to send on your behalf. Watch your lookup budget: mechanisms like include, a, mx, ptr, and exists, plus the redirect modifier, all count against the limit below.
RFC 7208 section 4.6.4 imposes a hard limit of 10 DNS lookups during SPF evaluation. Exceeding it causes a PermError, which receiving servers may treat as a failure.
- Set up DKIM signing. SPF alone is not enough, especially if your emails are forwarded. Generate a signing key pair inside your email provider portal. Publish the public key as a DNS TXT or CNAME record. Receiving servers use it to confirm your From header and message body were not altered in transit.
- Deploy and align DMARC. Publish a DMARC record that ties your SPF and DKIM results to the RFC5322 From address through an alignment check. Relaxed alignment allows organizational domain matches, such as a subdomain passing for the main domain; strict alignment requires an exact domain match.
If you want to understand the technical differences in detail, you can review how SPF vs DKIM vs DMARC compared impacts your overall security posture. To ensure your current setup is correct, you should check your records step by step. Keep in mind that any time you update these DNS records, you must wait for standard DNS propagation time before the changes take full effect across the internet.
What DMARC Enforcement Does to Spoofers
Publishing a DMARC record is how you actively stop someone from spoofing your email domain. DMARC is designed to be rolled out gradually, and you control the enforcement level through your DMARC policy tag.
| Policy | What it Does | Risk to Legitimate Mail |
|---|---|---|
| p=none | Monitoring only; receiving servers take no action on failing messages, but the domain owner gets reports | None; messages are delivered normally, the safe starting point |
| p=quarantine | Failing messages are routed to the spam or junk folder instead of the inbox | Low, but only move here after your legitimate mail is confirmed to be authenticating cleanly |
| p=reject | Failing messages are rejected outright, ideally at the SMTP transaction level before the message is accepted | Highest protection; any legitimate mail that is not yet authenticating will be blocked too |
Work through these three tiers in order. Start at p=none to monitor without risk. Confirm your legitimate mail is passing. Then escalate to p=quarantine, and finally to p=reject to fully shut down spoofers.
You can also control enforcement gradually using the DMARC pct tag. The DMARC pct tag is a plain-text integer from 0 to 100 (default 100) that controls the percentage of the domain’s mail stream to which the published policy is applied.
Per RFC 7489 section 6.6.4, messages not selected for reject due to pct sampling should be treated as though p=quarantine applies. The pct tag must never be applied to DMARC-generated aggregate or forensic reports.
If you are wondering “my email is being spoofed what do i do,” your immediate action should be moving your DMARC policy to reject. This instantly tells the world to drop any fake emails claiming to be you.
However, remember what DMARC cannot fix. It will not stop attackers from using lookalike domains, and it will not protect you if an attacker successfully compromises one of your actual employee email accounts.
The Bulk-Sender Reality and Deliverability
Email authentication is no longer optional for businesses that rely on email communication. Major providers have drawn a hard line to protect their users from spam and phishing. If your domain is not authenticated, your legitimate emails will be blocked or sent to spam.
Google defines a bulk sender as any sender who sends close to 5,000 or more messages per day to personal Gmail accounts within a 24-hour period. Cross that line and SPF, DKIM, and a published DMARC record stop being optional.
Google and Yahoo both rolled out bulk-sender authentication requirements in February 2024. Here is how the two compare.
| Requirement | Yahoo | |
|---|---|---|
| Bulk-sender threshold | Close to 5,000+ messages/day to personal Gmail accounts within 24 hours | Same high-volume sender category |
| Enforcement start | February 1, 2024 | February 2024 |
| Authentication | SPF and DKIM required | Valid SPF and DKIM authentication required |
| DMARC | Required; p=none is acceptable | Required; at least p=none |
| From-domain alignment | Required as part of DMARC | Required, aligned with SPF or DKIM |
| Spam rate | Below 0.10% target in Postmaster Tools, 0.30% hard ceiling | Below 0.30% spam complaint rate |
| Unsubscribe | One-click unsubscribe required; RFC 8058 one-click unsubscribe required by June 1, 2024 for senders already including an unsubscribe link | Functioning one-click list-unsubscribe headers, honored within 2 days |
| DNS hygiene | Covered under SPF/DKIM authentication | Valid forward and reverse DNS records |
| Escalation | November 2025: temporary and permanent rejections for non-compliant senders. Beginning June 2024: a reported spam rate above 0.30% makes a sender ineligible for mitigation until it stays below 0.30% for seven consecutive days | Not specified beyond the core requirements above |
Failing to secure your domain can also land your IP addresses on severe blocklists, such as the Spamhaus ZEN blocklist. ZEN merges four Spamhaus IP lists: the Blocklist (SBL), Combined Spam Sources (CSS), Exploits Blocklist (XBL), and Policy Blocklist (PBL).
An IP listed in ZEN is typically rejected by receiving mail servers during the SMTP connection phase, blocking delivery regardless of content or authentication.
Your DMARC Rollout Checklist
- [ ] SPF record published, covering every platform that sends mail on your behalf (Microsoft 365, Google Workspace, marketing tools)
- [ ] DKIM signing enabled and the public key published in DNS
- [ ] DMARC record published at p=none and aggregate reports reviewed
- [ ] Legitimate mail confirmed passing SPF or DKIM alignment
- [ ] DMARC policy escalated to p=quarantine
- [ ] DMARC policy escalated to p=reject
- [ ] Spam complaint rate confirmed below 0.30% (the Google and Yahoo bulk-sender ceiling)
- [ ] One-click unsubscribe implemented on marketing mail
See Where You Stand
Free Email Domain Security Grader: enter your domain, we check your real SPF, DKIM, and DMARC records and grade your spoofability in seconds.
Related Guides
- SPF, DKIM & DMARC Record Check: Test and Fix Your Domain
- Business Emails Going to Spam? Blacklists and Auth Fixes
- DMARC Policy: None vs Quarantine vs Reject Explained
Frequently Asked Questions
Can email spoofing be stopped?
Yes, exact-domain spoofing can be completely stopped. The mechanism is straightforward: configure SPF, DKIM, and DMARC records for your domain, then move your DMARC policy to reject. At that point, receiving mail servers automatically block unauthorized emails claiming to be from your business. Lookalike domain spoofing is different — it requires defensive domain registration and ongoing employee training, because it operates from attacker-owned domains your records cannot control.
Should I be worried if my email is spoofed?
Yes, take it seriously. When attackers spoof your domain, they send phishing links, fake invoices, or malware to your clients and vendors while wearing your trusted brand name. The damage hits your business reputation directly and can cause major email providers to blacklist your legitimate communications.
How to solve email spoofing?
The solution for exact-domain spoofing has three stages. First, publish a Sender Policy Framework (SPF) record to authorize your sending servers. Second, set up DomainKeys Identified Mail (DKIM) cryptographic signatures so receiving servers can verify your messages have not been altered. Third, publish a DMARC record and escalate the policy gradually: start at none for monitoring, then move to quarantine, and finally reach reject to block spoofers outright.
Why do I keep getting spoofed emails?
You receive spoofed emails because the sending domains lack strict DMARC enforcement — attackers freely forge any unprotected address. If the spoofed emails look like they come from inside your own company (your CEO’s name on a random Gmail address), that is display-name spoofing. Tighten your incoming spam filters and anti-phishing policies to block these inbound threats at the gateway.
How do I fix my email being spoofed?
Start by auditing your current DNS TXT records to confirm SPF and DKIM are correctly configured for every platform that sends on your behalf. Next, publish a DMARC record to monitor unauthorized sending sources. Once you have verified your legitimate mail is passing authentication, change your DMARC policy to p=reject to block the spoofers at the receiving server.
How do I stop 100s of spam emails daily?
Stopping inbound spam requires configuring aggressive spam filtering rules within your email provider, such as Microsoft 365 or Google Workspace. Make sure your incoming mail server respects the DMARC policies of external senders so forged mail is rejected before it reaches any inbox. Anti-spoofing records protect your outgoing identity, but cleaning up your own inbox requires dedicated inbound threat protection software.
Secure Your Business Communications
Protecting your domain from impersonation is a critical part of modern business operations. LeadingIT is a Chicagoland managed it and cybersecurity provider that has helped Illinois businesses since 2010. We serve roughly 200 organizations and over 2,500 users from our offices in Woodstock and Manteno.
We actively configure and enforce SPF, DKIM, and DMARC for client domains as part of our managed email security, monitoring deliverability and blocking spoofing attempts. If you need help securing your domain, explore LeadingIT’s managed cybersecurity services (done-for-you path), book a call with our team, or contact us directly at 815-788-6041.
