Email spoofing: how scammers send email in your company’s name
Right now, if your domain is not protected properly, someone could send an email that looks like it came from your company. It could use your name, your domain, your logo and your reputation to trick a client, supplier or member of staff.
Why scammers can send email in your company’s name
Email was built in a more trusting time.
The system that delivers email does not, on its own, check that the sender is who they claim to be. The From address on an email is a bit like the return address handwritten on an envelope. Anyone can write anything there.
Spoofing takes advantage of that.
A scammer puts your domain in the From field, sends the message, and unless your domain is set up to challenge it, the receiving mail server may have no clear reason to reject it.
The result: your client receives an email that appears to come from you, asking them to pay an invoice, change bank details, open a file or reply with information.
That is why the National Cyber Security Centre publishes anti-spoofing guidance for organisations. It helps reduce the chance of fake emails being sent in your name.
The three records that stop email spoofing
Three DNS records work together to prove an email really came from your domain.
You add them at your domain registrar or DNS host. Receiving mail servers then check them when they receive mail that claims to be from you.
SPF: Sender Policy Framework
SPF is a list of the mail servers allowed to send email for your domain.
When a receiving server gets a message claiming to be from you, it checks whether the sending server is on that list. If a server that is not on the list tries to send as your domain, SPF flags it.
DKIM: DomainKeys Identified Mail
DKIM adds a tamper-proof signature to every message you send.
Your mail service signs outgoing email with a private key. The matching public key sits in your DNS. The receiving server checks the signature to confirm the message came from your domain and was not altered on the way.
DMARC: Domain-based Message Authentication, Reporting and Conformance
DMARC ties SPF and DKIM together.
It tells receiving mail servers what to do when a message fails the check. It also checks that the visible From address lines up with the domain authenticated by SPF or DKIM.
That alignment is what helps stop someone forging your exact domain.
The DMARC setting most businesses get wrong
DMARC has three main policy settings.
- p=none
This tells receiving servers to do nothing when a message fails. It monitors and sends reports, but it does not block spoofed email. - p=quarantine
This tells receiving servers to send failing messages to the junk or spam folder. - p=reject
This tells receiving servers to reject failing messages before they arrive.
The common mistake: a business sets DMARC to p=none, starts receiving reports, and then never moves any further.
Monitoring is useful at the start. It helps you find all the legitimate services sending email for your domain, such as Microsoft 365, your website, accounts software, CRM, helpdesk, booking system or newsletter platform.
But p=none is not protection. It is observation.
Real domain protection starts when DMARC moves to quarantine or reject after your legitimate mail sources have been checked.
What SPF, DKIM and DMARC do not stop
SPF, DKIM and DMARC help stop someone forging your exact domain.
They are important. But they do not stop every type of email impersonation.
- Lookalike domains.
A scammer can register a domain that looks similar to yours, such as yourcompany-invoices.co.uk or a spelling variation of your real domain. Your records protect your real domain, not a different one the attacker owns. - Display-name spoofing.
The sender name might say “Your Company Accounts” while the real email address behind it is a random Gmail, Outlook or newly registered domain. DMARC checks the domain, not the display name.
That is why staff still need simple payment habits: check the full email address, do not trust display names, and verify any request to change bank details by calling a known number, not one from the email.
Why this matters even if you do not send bulk email
There are two reasons small organisations should care about email authentication.
1. It protects your reputation
If someone spoofs your domain, the first person to suffer may not be you. It may be a client, parent, supplier, patient, donor or customer who trusts your name.
A spoofed invoice or fake bank-detail change can damage trust quickly, even if your own mailbox was never hacked.
2. It helps your email get delivered
Major mailbox providers now expect properly authenticated email.
Google and Yahoo introduced sender requirements in 2024 for bulk senders, including SPF, DKIM and DMARC. Microsoft introduced similar requirements for high-volume senders to Outlook.com and Hotmail in 2025.
Sources: Google and Yahoo sender requirements summary and Microsoft Outlook high-volume sender requirements.
Even if you are below those thresholds, proper authentication is still a sensible baseline. It shows mailbox providers that your domain is managed properly.
How to check and fix your domain
You can get a rough sense of where you stand without doing any technical work.
Free SPF, DKIM and DMARC checkers can show whether your domain has records in place. That tells you whether something exists, although it does not always prove the records are complete or correctly configured.
Fixing the records properly is a job for whoever manages your IT, your domain or your DNS. A mistake can send legitimate email to spam, so the safest rollout is done in stages.
- Identify every legitimate service that sends email for your domain.
- Publish or tidy up SPF so approved mail sources are listed.
- Enable DKIM signing for your main mail platform and other sending services.
- Add DMARC at p=none so reports can be reviewed safely.
- Fix any legitimate senders that are failing authentication.
- Move DMARC to p=quarantine, then to p=reject once the reports look clean.
Sendmarc can make this much easier. Instead of trying to read raw DMARC reports, you get clearer visibility of who is sending email using your domain and a practical route towards enforcement.
Learn more on our Sendmarc domain protection page.
Frequently asked questions
What is email spoofing?
Email spoofing is when someone sends a message with your domain in the From address to make it look like it came from your company. It is often used to trick clients, suppliers or staff into paying fake invoices, changing banking details or handing over information.
What are SPF, DKIM and DMARC in simple terms?
SPF is a list of servers allowed to send email for your domain. DKIM is a signature that proves a message came from you and was not altered. DMARC ties the two together, tells receiving servers what to do with messages that fail, and reports who is sending email as your domain.
Does DMARC stop all email impersonation?
No. DMARC helps stop someone forging your exact domain. It does not stop lookalike domains or display-name spoofing, where the sender name looks familiar but the real email address is different. Those still need staff awareness and payment-verification habits.
Will setting up DMARC block my own emails?
Not if it is rolled out properly. Starting at p=none lets you review reports and confirm your legitimate mail passes before moving to quarantine and then reject. Problems usually happen when a domain is pushed to reject before all sending services have been checked.
Do I need SPF, DKIM and DMARC if I do not send many emails?
Yes. These records protect your domain from being spoofed regardless of how much email you send. They also help mailbox providers trust that your email is legitimate.
Final thought
Email spoofing is not just a technical problem. It is a trust problem.
If someone can send email in your name, they can use the reputation you have built to attack the people who trust you.
SPF, DKIM and DMARC are not exciting. But when they are configured properly, they make that much harder.
