Cyber Security Guide

Could Someone Send Emails Pretending To Be Your Business?

Email spoofing is one of the simplest ways scammers can damage trust in your business. The good news is that three DNS records — SPF, DKIM and DMARC — can make it much harder for criminals to send convincing emails using your domain.

Right now, without the right protections in place, someone could send an email that looks like it came from your company. The “From” line could show your domain. Your logo could be copied into the message. The email could ask a client to pay a fake invoice, update banking details, or click a malicious link.

That is called email spoofing, and it is often the starting point for invoice fraud, supplier impersonation and business email compromise.

In plain English: email spoofing is like someone writing your return address on an envelope. Unless receiving mail systems are told how to verify the sender, the message can still look believable when it arrives.

Why Scammers Can Send Emails In Your Company’s Name

Email was built in a more trusting time. By default, the email system does not always know whether the visible sender address is genuine. That means a criminal can place your domain in the “From” field and send a message that appears to come from your business.

This is why anti-spoofing controls matter. The UK’s National Cyber Security Centre says its email security guidance is designed to help organisations secure email systems by “making it difficult for fake emails to be sent from your organisation’s domains”.

“Help protect the individuals and organisations you do business with by making it difficult for cyber criminals to spoof your email address.”
Source: National Cyber Security Centre email security and anti-spoofing guidance

For businesses, this is not just a technical issue. It is a trust issue. If a client receives a fake invoice that appears to come from your domain, they may not immediately blame the criminal. They may wonder whether your systems, your processes or your security were reliable enough in the first place.

The Three Records That Help Stop Email Spoofing

SPF, DKIM and DMARC are DNS records that work together to prove whether an email really came from your domain. They are added where your domain’s DNS is managed, such as your domain registrar, hosting provider or Microsoft 365 DNS settings.

SPFSender Policy Framework is a list of the mail servers allowed to send email for your domain.

DKIMDomainKeys Identified Mail adds a digital signature that helps prove the message was sent by an authorised system and was not altered on the way.

DMARCDomain-based Message Authentication, Reporting and Conformance tells receiving mail servers what to do when an email fails SPF or DKIM checks.

SPF: Who Is Allowed To Send For You?

SPF is like an approved sender list. It tells the world which servers and services are allowed to send email on behalf of your domain.

For example, your SPF record might include Microsoft 365, your website, your CRM, your marketing platform or your invoicing system. If a message claims to come from your domain but is sent from a server that is not on the list, SPF can flag it as suspicious.

DKIM: Has The Email Been Signed Properly?

DKIM adds a digital signature to outgoing email. The sending system signs the message using a private key. The matching public key is published in your DNS. When the message arrives, the receiving server checks that signature.

If the signature is valid, it helps prove that the email came from an authorised sender and that the message was not changed during delivery.

DMARC: What Should Happen If The Checks Fail?

DMARC sits on top of SPF and DKIM. It checks whether the domain in the visible “From” address lines up with the domain that passed SPF or DKIM. This alignment is important because it helps stop criminals from forging your exact domain in a way that looks convincing to clients and staff.

Microsoft Learn explains that DMARC validates mail sent from a Microsoft 365 organisation and helps prevent spoofed senders used in business email compromise, ransomware and phishing attacks.

“DMARC policy specifies what to do with messages that fail DMARC — reject, quarantine, or no instruction.”
Source: Microsoft Learn, Set up DMARC to validate email in Microsoft 365

/wp-content/uploads/spf-dkim-dmarc-email-security-diagram.jpg

Suggested image: a simple visual diagram showing SPF, DKIM and DMARC working together to protect your domain.

The DMARC Setting Many Businesses Get Wrong

Many businesses publish a DMARC record but leave it in monitoring mode. That is useful at the start, but it does not give full protection if it never moves beyond that stage.

DMARC policy	What it does	What it means for protection
p=none	Monitors failed messages and sends reports.	Useful for testing, but it does not tell receivers to block spoofed email.
p=quarantine	Asks receiving servers to treat failing messages as suspicious.	Failing emails may be sent to junk or marked as spam.
p=reject	Asks receiving servers to reject failing messages.	This is the strongest policy and the end goal for most active domains.

The common mistake: setting DMARC to p=none, seeing that reports are being generated, and assuming the domain is protected. Monitoring is not the same as blocking.

Microsoft recommends a gradual rollout: start with p=none, monitor the reports, move to p=quarantine, and then work towards p=reject once legitimate mail has been checked and corrected.

Why This Matters Even If You Do Not Send Bulk Email

You do not need to send huge volumes of email to be targeted. If your domain has a good reputation, cyber criminals may try to misuse it because your clients and suppliers recognise it.

There are two main reasons to get SPF, DKIM and DMARC right:

1. ProtectionIt helps protect your clients, suppliers and team from emails pretending to come from your business.

2. ReputationIt helps protect trust in your brand and reduces the chance of your domain being associated with fraud.

3. DeliverabilityAuthenticated email is more likely to be trusted by mailbox providers than unauthenticated mail.

Deliverability is becoming more important too. Google’s email sender guidance says all senders should use SPF or DKIM, while bulk senders must use SPF, DKIM and DMARC. Google also says authenticated messages help protect recipients from spoofing and phishing, help protect organisations from impersonation, and are less likely to be rejected or marked as spam.

Yahoo’s sender requirements also state that bulk senders should implement SPF and DKIM, publish a valid DMARC policy of at least p=none, and ensure the domain in the “From” header aligns with either SPF or DKIM.

What SPF, DKIM And DMARC Do Not Stop

These records are important, but they are not a magic shield against every type of impersonation. There are two common tactics they do not fully prevent.

Lookalike Domains

A scammer may register a domain that looks similar to yours. For example, they might use a hyphen, add the word “invoices”, or change the ending of the domain. Your SPF, DKIM and DMARC records protect your real domain, not a separate domain owned by an attacker.

Display Name Spoofing

The sender name might say “Your Company Accounts”, but the actual email address could be a completely different domain or even a free mailbox. DMARC checks the domain. It does not stop people from typing a misleading display name.

Best habit: never rely on the display name alone. Check the full email address and verify payment changes using a known phone number, not the contact details provided in the suspicious email.

How To Check And Fix Your Domain

You can get a rough idea of your current setup by using a reputable SPF, DKIM or DMARC checker and typing in your domain. This can show whether the records exist, but it does not always confirm whether they are correctly configured for every legitimate sender.

Fixing the records properly is a job for whoever manages your IT, Microsoft 365 tenant, website, DNS or email systems. That is because mistakes can affect genuine email delivery.

Identify every legitimate email sender.
Include Microsoft 365, your website, CRM, accounts software, marketing platform, ticketing system and any third-party tool that sends email on your behalf.
Make sure SPF is accurate.
Your SPF record should include all approved sending services without becoming too broad or overloaded.
Enable DKIM signing.
DKIM should be active for your main email platform and any third-party systems that support signing with your domain.
Publish DMARC in monitoring mode.
Start with p=none and review the reports to see which services are passing or failing.
Fix legitimate failures.
If genuine systems are failing DMARC, correct SPF, DKIM or alignment before tightening the policy.
Move towards enforcement.
Once the reports look clean, move to p=quarantine, then eventually p=reject.

A Simple Business Checklist

Do you know every system that sends email using your domain?
Does your SPF record include all legitimate senders?
Is DKIM enabled for Microsoft 365 and relevant third-party platforms?
Do you have a DMARC record published?
Is DMARC still stuck at p=none?
Are DMARC reports being reviewed by someone who understands them?
Do staff know how to verify payment detail changes safely?
Are lookalike domains being monitored?

The Bottom Line

Email spoofing is not clever because it is complicated. It is clever because it exploits trust. Your clients trust your name, your domain and your usual way of communicating. SPF, DKIM and DMARC help protect that trust by making it much harder for criminals to send emails pretending to be you.

The key is not simply having a DMARC record. The key is moving it carefully from monitoring to enforcement, so your genuine email keeps flowing while spoofed messages are stopped before they can cause damage.

Want To Know If Your Domain Can Be Spoofed?

Bespoke IT Solutions can review your SPF, DKIM and DMARC setup, check whether your email domain is properly protected, and help you move safely towards stronger enforcement without disrupting your day-to-day email.

/contact-us/Speak To Bespoke IT Solutions

Frequently Asked Questions

What is email spoofing?

Email spoofing is when someone sends a message that appears to come from your domain, even though it was not sent by your business. It is often used in phishing, fake invoice scams and payment redirection fraud.

What are SPF, DKIM and DMARC in simple terms?

SPF says which servers are allowed to send email for your domain. DKIM adds a digital signature to prove the message has not been altered. DMARC tells receiving servers what to do if SPF or DKIM checks fail and whether the visible sender domain aligns properly.

Does DMARC stop every type of impersonation?

No. DMARC helps stop attackers from spoofing your exact domain. It does not stop lookalike domains or misleading display names, so staff awareness and payment-verification processes are still important.

Will DMARC block our own emails?

It can if it is rushed or configured incorrectly. That is why DMARC should usually be rolled out in stages, starting with p=none, then moving to p=quarantine and finally p=reject once legitimate senders are confirmed.

Do small businesses need SPF, DKIM and DMARC?

Yes. Even if you do not send large volumes of email, your domain can still be targeted. These records help protect your clients, your suppliers, your staff and your business reputation.