If you've ever received an email that looked like it came from someone you know, only to discover it was fake, you've seen email spoofing in action.
Now imagine that email appears to come from your business.
To your customer, supplier, or employee, it looks completely legitimate. Your company name is there. Your email address is there. Your logo may even be copied into the message. The email asks them to pay an invoice, update banking information, or send sensitive data.
The only problem is that you never sent it.
This type of attack is one of the most common ways scammers commit business email fraud, and it's exactly what SPF, DKIM, and DMARC were designed to prevent.
Most businesses have heard of these records. Many even have one or two configured. Unfortunately, having only part of the puzzle in place can leave your domain just as vulnerable as having none at all.
Why email spoofing works
Email wasn't originally designed with today's cybersecurity threats in mind.
When someone sends an email, the receiving mail server doesn't automatically know whether the sender actually owns the address shown in the From field. Without additional verification, that address is simply information the sender provides.
That means a scammer can send an email claiming to come from yourcompany.com, even if they have never had access to your systems.
Unless your domain has been configured to verify legitimate senders, the receiving mail server may accept that message as genuine.
That's why organizations like the UK's National Cyber Security Centre recommend implementing anti spoofing protections for every business domain.
The three records that protect your domain
Three DNS records work together to verify that email sent from your domain is legitimate.
These records are published in your domain's DNS settings. Every time you send an email, the receiving mail server checks those records before deciding whether to trust the message.
SPF (Sender Policy Framework)
SPF identifies which mail servers are authorized to send email on behalf of your domain.
When someone receives an email claiming to come from your business, their mail server compares the sending server against your published SPF record.
If the sending server isn't listed, SPF marks the message as suspicious.
DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic signature to every outgoing email.
Your mail server signs each message using a private key, while the corresponding public key is stored in your DNS records.
When the recipient's mail server receives the email, it verifies that signature to confirm two things:
- The message genuinely came from your domain.
- The contents of the message were not modified after it was sent.
DMARC (Domain based Message Authentication, Reporting and Conformance)
DMARC builds on SPF and DKIM by telling receiving mail servers what to do when authentication fails.
It also verifies that the domain shown in the visible From address matches the domain validated by SPF or DKIM. That alignment is what prevents someone from successfully impersonating your exact email address.
In addition, DMARC generates reports showing who is attempting to send email using your domain, including legitimate services you may have forgotten about and unauthorized senders attempting to spoof your business.
The setting that often gets overlooked
Simply creating a DMARC record isn't enough.
DMARC has three policy levels:
- p=none monitors activity and generates reports but does not stop spoofed email.
- p=quarantine tells receiving mail servers to place failing messages into spam or junk folders.
- p=reject instructs receiving mail servers to reject failing messages entirely.
This is where we frequently find businesses falling short.
Many organizations publish a DMARC record with a p=none policy so they can begin collecting reports. Unfortunately, they never move beyond that first step.
While the reports are valuable, p=none does not protect your domain. It simply tells you spoofing is happening.
Real protection begins once your policy advances to quarantine or, preferably, reject after you've verified that all legitimate email sources are authenticating correctly.
Microsoft recommends exactly this approach: begin with monitoring, validate your legitimate mail flow, then gradually enforce your DMARC policy.
"If DMARC is working, why am I still seeing spoofed emails?"
This is a question we've received from several of our managed clients.
The answer is that SPF, DKIM, and DMARC don't control every message you receive. They control how other mail systems verify email claiming to come from your domain.
Some clients have noticed spoofed messages arriving with Proofpoint warning banners or modified subject lines and have wondered why they weren't simply blocked.
In these cases, Proofpoint is actually doing its job.
Proofpoint evaluates every incoming message using dozens of different signals, including sender reputation, authentication results, malicious links, attachments, and behavioral analysis.
Sometimes it determines the safest action is to quarantine the message or clearly flag it as suspicious rather than silently discard it. That gives users visibility into what was received while making it obvious the message should not be trusted.
So, if you've seen one of these messages recently, it doesn't necessarily mean your protections failed. In many cases, it means multiple layers of protection are working together exactly as intended.
What these records don't protect against
SPF, DKIM, and DMARC are extremely effective at preventing someone from spoofing your exact domain, but they don't eliminate every type of phishing attack.
One common tactic is registering a lookalike domain, such as yourcompany-support.com or yourcompany.co instead of yourcompany.com. Since the attacker owns that domain, your authentication records can't prevent them from sending email from it.
Another technique is display name spoofing. The sender name might say "Your Company Accounting," while the actual email address behind it belongs to an unrelated Gmail account.
That's why it's still important to verify the full sender address and independently confirm any request involving payments, banking information, or other sensitive financial changes.
Why every business should have these records
Even if your company only sends a handful of emails each day, SPF, DKIM, and DMARC are still important.
First, they help prevent scammers from impersonating your business and damaging your reputation.
Second, they improve email deliverability.
Google and Yahoo introduced new authentication requirements for bulk senders in February 2024. Microsoft followed with similar requirements for Outlook.com and Hotmail in 2025. Even businesses sending far fewer messages benefit because properly authenticated domains are generally considered more trustworthy and are less likely to have legitimate email filtered into spam.
Have you checked your domain lately?
There are several free online tools that can tell you whether SPF, DKIM, and DMARC records exist for your domain.
However, simply having the records isn't enough. They need to be configured correctly, and changes should be made carefully. An incorrect SPF record or an improperly enforced DMARC policy can cause legitimate email to fail authentication.
The recommended process is to configure SPF and DKIM first, publish DMARC in monitoring mode, review the reports, then gradually move to quarantine and finally reject once you're confident every legitimate mail source is covered.
For our managed IT clients, this is already part of what we do. We configure, monitor, and maintain these records as part of our Microsoft 365 management, so you don't have to worry about keeping up with changing email authentication requirements.
If you're not sure whether your domain is properly protected, or you've never looked at your SPF, DKIM, and DMARC records before, we'd be happy to help you review them.
