Could a Cyber Criminal Send Emails Pretending to Be Your Company Today?

Imagine one of your customers receives an email from what appears to be your accounts department.

The branding looks correct.

The signature looks genuine.

The email address seems legitimate.

The message simply says:

“We’ve changed our bank details. Please send future payments to the account below.”

Your customer follows the instructions.

Thousands of pounds disappear.

The problem? The email never came from your business.

It was sent by a cyber criminal pretending to be you.

This type of attack is known as email spoofing, and it remains one of the most effective ways criminals trick clients, suppliers and staff into making payments, revealing information, or downloading malicious files.

Fortunately, there are three powerful technologies that can make this dramatically harder: SPF, DKIM and DMARC.

---

Why Scammers Can Send Emails Using Your Company Name

Email was designed decades ago when trust was assumed rather than verified.

Unlike logging into your bank account or Microsoft 365, traditional email doesn’t automatically prove that the sender is who they claim to be.

Think of the “From” address on an email like a return address written on an envelope. Anyone can write anything they want there.

Unless protections are in place, cyber criminals can create emails that appear to come directly from your organisation.

The UK’s National Cyber Security Centre (NCSC) specifically recommends anti-spoofing controls to prevent criminals abusing your company’s identity.

---

A Real-World Example

Let’s imagine your business is called ABC Engineering Ltd.

A criminal doesn’t need to hack your systems.

They don’t need your password.

They don’t even need access to Microsoft 365.

Instead, they simply create an email that appears to come from:

accounts@abcengineering.co.uk

A supplier receives the message requesting payment to a new bank account.

Everything looks genuine.

The payment is made.

The fraud isn’t discovered until days later.

This form of attack is known as Business Email Compromise (BEC), and it successfully targets organisations of every size because it exploits trust rather than technology.

---

The Three Records That Stop Email Spoofing

Three DNS records work together to prove your emails genuinely come from your organisation.

These are published once in your domain settings and then checked automatically every time you send an email.

SPF (Sender Policy Framework)

SPF acts as an authorised mailing list.

It tells receiving email servers which systems are allowed to send email on behalf of your domain.

If an unauthorised server attempts to send email pretending to be you, SPF helps identify it as suspicious.

DKIM (DomainKeys Identified Mail)

DKIM adds a unique digital signature to every email you send.

This confirms two important things:

• The email genuinely came from your organisation.
• The content hasn’t been tampered with during delivery.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC ties SPF and DKIM together.

It tells receiving mail systems exactly what to do when an email fails authentication.

It also generates reports showing who is sending email using your domain.

Think of DMARC as the security guard that decides whether suspicious visitors are allowed through the door.

---

The DMARC Setting That Creates a False Sense of Security

This is one of the most common issues we encounter when reviewing business email security.

Many organisations have DMARC enabled but believe they are protected when they are not.

Policy 1: p=none

This policy only monitors activity.

Suspicious emails are still delivered.

You receive reports, but the spoofed emails are not blocked.

Policy 2: p=quarantine

Suspicious emails are diverted to spam or junk folders.

Policy 3: p=reject

Suspicious emails are blocked completely before they reach the recipient.

Real protection begins when organisations move beyond monitoring and start actively enforcing DMARC policies.

---

What SPF, DKIM and DMARC Don’t Prevent

These protections are extremely effective, but they aren’t magic.

There are still two common attacks businesses should be aware of.

Lookalike Domains

A criminal could register a domain such as:

• yourcompany-services.co.uk
• yourcompany-invoices.com
• yourcompanny.co.uk

Because they own that domain, your DMARC settings cannot stop them using it.

Display Name Spoofing

A criminal could send an email from a Gmail address whilst displaying:

“Your Company Accounts Team”

The displayed name looks genuine even though the actual address is unrelated.

This is why staff awareness and payment verification procedures remain essential.

---

Why This Matters Even If You Don’t Send Marketing Emails

Many business owners assume these protections only matter for high-volume email senders.

That’s not the case.

There are two significant benefits:

1. Protect Your Reputation

SPF, DKIM and DMARC make it much harder for criminals to impersonate your organisation.

That protects your customers, suppliers and staff.

2. Improve Email Deliverability

Email providers increasingly expect authentication controls to be present.

Without them, legitimate emails are more likely to be filtered, delayed or marked as spam.

If you’re sending quotes, invoices, contracts or customer updates, that’s a problem worth avoiding.

---

Five Warning Signs Your Domain May Not Be Fully Protected

• You don’t know whether SPF, DKIM or DMARC are configured.
• Your DMARC policy remains set to p=none.
• You use multiple platforms to send email.
• Customers have reported suspicious emails claiming to come from you.
• Your emails occasionally land in spam folders.

If any of these sound familiar, it’s worth carrying out a review.

---

How to Check Your Domain

Several free online tools can quickly identify whether SPF, DKIM and DMARC records exist for your domain.

However, having records present does not necessarily mean they’re configured correctly.

Many businesses discover that systems such as website contact forms, marketing platforms, CRM systems or third-party services have been overlooked.

A proper review ensures all legitimate senders are authenticated before DMARC enforcement is introduced.

---