To stop scammers spoofing your email domain, publish an SPF record, turn on DKIM signing for every service that sends as you, and add a DMARC record that you move from p=none to p=reject once your own mail passes. Receivers that honour DMARC will then refuse forged mail using your exact domain. Lookalike domains need separate monitoring and reporting.
Below we explain how spoofing works, the rollout plan to reach p=reject safely, how to protect domains you don't send from, and what to do when customers receive fake emails in your name.
Key takeaways
- Publish SPF, enable DKIM for every sender and move DMARC from p=none to p=reject so receivers refuse forged mail using your exact domain.
- Read DMARC reports for two to four weeks at p=none and fix every legitimate source before moving to quarantine and then reject.
- Protect parked domains with v=spf1 -all, a DMARC reject policy, a null MX record and an empty DKIM key, as the UK's NCSC recommends.
- DMARC cannot stop lookalike or display-name spoofing, so register obvious domain variations and confirm bank detail changes by phone.
What is email spoofing?
Spoofing is sending email with a forged From address. The basic email protocol (SMTP) doesn't check that the sender owns the address it claims, so anyone can send a message showing accounts@yourcompany.com. Scammers use this for fake invoices, changed bank details, delivery scams and password-reset phishing aimed at your customers, suppliers and staff.
There are three forms, and they need different defences:
| Type | Example | Stopped by DMARC? |
|---|---|---|
| Exact-domain spoofing | From: accounts@yourcompany.com |
Yes, at p=quarantine or p=reject |
| Lookalike (cousin) domain | From: accounts@yourcompany-mail.com or yourcornpany.com |
No: it's a different domain |
| Display-name spoofing | From: "Your Company Accounts" <random@freemail.com> |
No |
How do I know if someone is spoofing my domain?
- Customers or suppliers forward odd emails "from" you, or ask about invoices you didn't send.
- You receive bounces for messages you never sent (backscatter).
- DMARC aggregate reports show IP addresses you don't recognise sending as your domain. This is the most reliable signal. See how to read DMARC reports.
If you don't have a DMARC record yet, you have no visibility at all. Check yours now with the free DMARC checker.
How do SPF, DKIM and DMARC stop spoofing?
- SPF lists the servers allowed to send for your domain.
- DKIM adds a cryptographic signature that only your authorised senders can produce.
- DMARC ties them to the visible From address and tells receivers what to do when neither passes in alignment: nothing (
p=none), send to spam (p=quarantine) or refuse (p=reject).
SPF and DKIM on their own don't protect the From address people see. Only DMARC at enforcement does. The UK National Cyber Security Centre's (NCSC) email security guidance recommends all three. For the detail of each record and how they fit together, see DMARC explained.
How do I get to DMARC p=reject without breaking my own email?
- Inventory your senders. Your mailbox provider, newsletter tool, CRM, helpdesk, accounting software, website forms, booking system, and anything an agency set up years ago.
- Publish SPF covering them, as a single record within the 10-lookup limit. The SPF checker validates it.
- Enable DKIM with your own domain in each service. On Microsoft 365, custom domains aren't DKIM signed until you turn it on.
- Publish DMARC in monitoring mode:
_dmarc TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com"
- Read reports for two to four weeks. Fix every legitimate source that fails. Ignore unknown sources that fail; that's spoofing.
- Move to quarantine:
_dmarc TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourcompany.com"
- Move to reject once reports stay clean:
_dmarc TXT "v=DMARC1; p=reject; rua=mailto:dmarc@yourcompany.com"
The latest DMARC standard, RFC 9989 (May 2026), also defines an np tag that sets the policy for subdomains that don't exist, closing a gap scammers have used with made-up subdomains. Support among receivers is still growing, so keep p and sp at enforcement too.
Our DMARC record generator builds each stage, and MakeItFlow's email deliverability check confirms the policy is live alongside SPF, DKIM, MTA-STS and BIMI.
How do I protect domains I don't send email from?
Parked domains, old brand names and defensive registrations are easy targets because nobody watches them. The NCSC recommends these records for domains that never send mail:
@ TXT "v=spf1 -all"
_dmarc TXT "v=DMARC1; p=reject;"
@ MX 0 .
*._domainkey TXT "v=DKIM1; p="
The first says no server may send for the domain, the second rejects anything claiming to, the null MX (from RFC 7505) says the domain accepts no mail, and the empty DKIM key revokes any signatures. Add a rua= address to the DMARC record if you want reports. The NCSC notes some DNS interfaces won't accept every record, so add as many as you can.
What about lookalike domains?
DMARC can't stop someone registering yourcompany-invoices.com. To reduce the risk:
- Register obvious variations of your domain (.com, your country code such as .co.uk or .ca, common misspellings) and protect them as parked domains.
- Monitor new registrations using a brand or domain monitoring service; many registrars and security vendors offer this.
- Report abusive domains to the registrar or host listed in WHOIS, and to your national cyber security agency (the NCSC in the UK).
- Agree a payment-change process with customers and suppliers: bank details are never changed by email alone, and are always confirmed by phone using a known number.
- Consider BIMI once you're at enforcement. It shows your verified logo in supporting inboxes, which helps recipients spot the real thing. See our BIMI guide.
What should I do if customers receive spoofed emails from my domain?
- Warn them through your website, social channels and a direct email, explaining what genuine messages from you look like.
- Ask recipients to report it. In the UK, suspicious emails can be forwarded to the NCSC's Suspicious Email Reporting Service at report@phishing.gov.uk. In the US, phishing emails can be forwarded to reportphishing@apwg.org and reported to the FTC at ReportFraud.ftc.gov.
- Report fraud losses to Report Fraud, the City of London Police service that replaced Action Fraud in December 2025, at reportfraud.police.uk or on 0300 123 2040. In the US, report cyber-enabled fraud to the FBI's Internet Crime Complaint Center at ic3.gov.
- Check whether you've been compromised. If the emails came from your real mailbox rather than a forged one, reset passwords, turn on multi-factor authentication, review mailbox forwarding rules and check that your domain hasn't been blacklisted.
- Tighten DMARC towards
p=rejectif you haven't already.
For a wider check of your domain, run a free website audit with MakeItFlow to see email authentication, DNS and website security results together.
Frequently asked questions
Can I completely stop my domain being spoofed?
You can stop most exact-domain spoofing reaching major providers, because Gmail, Microsoft and Yahoo honour DMARC policies. Receivers that don't check DMARC may still accept forged mail, and lookalike and display-name spoofing need separate defences.
Will p=reject affect my legitimate email?
Only if a legitimate service isn't authenticated with your domain. That's why you monitor at p=none first and fix every source before enforcing. Forwarded mail can occasionally fail, but DKIM usually survives simple forwarding.
How long does it take to reach p=reject?
For a small business with a handful of sending services, often four to eight weeks. Organisations with many tools, agencies or legacy systems may need several months of report review.
Is spoofing the same as my email being hacked?
No. Spoofing forges your address without touching your account. Hacking means someone has access to your real mailbox. Check the message headers: spoofed mail fails SPF, DKIM and DMARC for your domain, while mail sent from a hacked account passes.
Do I need a paid DMARC service?
Not necessarily. Small domains can read aggregate reports with free tools. Paid services help when you have many senders or need alerts, and with NCSC Mail Check retired, many organisations now use one for ongoing monitoring.
What to do next
Check whether your domain has a DMARC record today. If not, publish p=none with a reporting address, list every service that sends as you, and work through them until reports are clean. Protect any parked domains with the NCSC records above, then set a date to move to p=reject.
Sources
More guides for your industry
Free checklist (PDF)
Free accountants website checklist
31 practical checks for accountants: website speed and mobile, Google Business Profile and reviews, email security, booking and enquiry handling, and AI search visibility. Each one says why it matters, and many link to a free tool that checks it.
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above and this guide was last reviewed on 31 October 2026 . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
