Stop Scammers Spoofing Your Company’s Email Domain
Someone can send mail that appears to come from your domain. What SPF, DKIM and DMARC do, how a small business turns them on safely and what to do if spoofed.
A customer forwards you an invoice from your own company’s address, and nobody in your office sent it. If your domain has no email authentication set up, a stranger can get closer to that than you’d like. For most small businesses, fixing it is an afternoon’s work.
The Federal Trade Commission explains the problem in its small business guide on business email imposters: “A scammer sets up an email address that looks like it’s from your company,” and uses it to get “passwords and bank account numbers or to get someone to send them money.” You can’t stop every imitation, but you can make it much harder for mail to pass as coming from your exact domain.
What the three settings do
| Name | Its job | Plain version |
|---|---|---|
| SPF | “Lets you choose specific IP addresses that are authorized to send emails using your domain” | A list of who may send for you |
| DKIM | “Puts a digital signature on your outgoing mail” | A seal showing the message wasn’t altered |
| DMARC | Checks the sender matches the “from” address people see, and lets you tell receiving servers whether to reject, flag or take no action | Your instruction for mail that fails the checks |
The FTC’s email authentication guidance calls DMARC “the essential third tool.” Without it, the other two give receivers information but no instruction from you.
A safe rollout
The dangerous version of this project is the one that goes straight to blocking. Step through it in stages. These steps follow Google Workspace’s DMARC documentation; other providers use the same concepts.
Week one: list your senders
Write down everything that sends email using your domain: your mailbox provider, invoicing or accounting software, a newsletter tool, a website contact form, a scheduling app. This list is the most common thing people miss. Each one needs SPF or DKIM set up for your domain.
Week one: confirm SPF and DKIM
Google advises having SPF and/or DKIM in place first and allowing 48 hours before enabling DMARC. Ask your email host to confirm both.
Week two: publish DMARC in monitor mode
DMARC is a DNS TXT record at the name _dmarc.yourdomain. Google recommends “setting the policy option (p) to none” at the start. Mail is delivered normally and you receive reports. Add a report address (the rua tag) pointed at a dedicated mailbox, because report volume can be high. A record looks like this:
v=DMARC1; p=none; rua=mailto:[email protected]. Replace the address with your own and have your host confirm it before saving. Some domain hosts add your domain to the name automatically, so check the record after saving.Weeks three to six: read the reports
The reports show who is sending as your domain and whether they pass. Look for your own tools that fail, and fix them. Reports are raw XML, so free report readers or your IT provider can make them easier to follow.
Then tighten it
Google’s page says to move to quarantine, which sends failures to spam, and then to reject, which refuses them, once your legitimate mail passes consistently. It also offers a pct tag so you can apply the policy to a small share of messages first and raise it in steps.
Choosing the policy
| Policy | What receivers do with failures | When to use |
|---|---|---|
| none | Deliver normally and report | Start here |
| quarantine | Send to spam | After reports show your tools pass |
| reject | Refuse the message | Your long-term target |
What this will not stop
Email authentication protects your exact domain. A scammer can still register a similar-looking domain, swap a letter, or use a free webmail account with your company name in the display field. So this complements your payment rules and doesn’t replace them. Our articles on the layered fake-CEO invoice lure and invoices nobody remembers cover the receiving side, and a two-person payment rule limits the damage if a message slips through.
If your domain is being spoofed now
The FTC’s order of steps:
- Report the scam to local law enforcement, the FBI’s IC3 and the FTC at ReportFraud.ftc.gov.
- Notify your customers. If you email them, don’t include any links, since that teaches people to click the kind of message you are warning about.
- Tell your staff so they recognize it and can answer calls.
- Check the DMARC status above and start the rollout if you haven’t.
December is a reasonable time to prepare because payroll and year-end statements raise the stakes, as our piece on payroll and W-2 requests explains. Remember to tell your email provider and any vendor that sends on your behalf before you tighten the policy, so a legitimate invoice run doesn’t bounce on December 30.
One FTC figure shows how common the gap has been. A March 2017 FTC study of major online businesses found 86 percent used SPF, while fewer than 10 percent had implemented DMARC. That study is old, but it’s a useful reminder that a company’s size doesn’t mean someone has done this.
Questions owners ask
Will this affect my newsletter? It can, if your newsletter tool isn’t set up to authenticate as your domain. That is why monitor mode comes first, and why the sender list matters.
Do I need this if I only use a free webmail account? These records apply to a domain you control. A business that uses a free webmail address has no domain to protect, and customers have no way to tell your address from a lookalike. Moving to a mailbox on your own domain is the first step.
How do I know it worked? Ask your provider or IT person to confirm that the record is published and that a test message passes SPF, DKIM and DMARC. Then keep watching the reports, since a new invoicing tool added next year will need the same setup.
Who owns this long term? Name one person. Domain and DNS logins are often held by a former employee or a web designer you stopped working with. Write down who has them while you are doing this project, and add it to your year-end vendor records.