What is email spoofing?

Email spoofing is sending an email with a forged From address so it looks like it came from someone else, often a business its recipients trust. It is the basis of most invoice and payment fraud.

How do I stop people spoofing my domain?

Publish SPF, DKIM and DMARC records in your domain’s DNS, then move DMARC to quarantine or reject once you are sure your legitimate senders pass.

Will DMARC stop my own emails arriving?

Not if you start with p=none and watch the reports first. Moving straight to reject without checking can block a forgotten service, such as a booking system, that sends on your behalf.

Does the free check look at my email setup?

Yes. It reads your public SPF, DKIM and DMARC records and includes them in your score.

Security guide

Can someone send email as your business?

Without three short DNS records, anyone can send an email that appears to come from your domain: fake invoices to your customers, fake payment requests to your staff. Most small businesses we check are missing at least one of them.

Run the free security check

SPF: who is allowed to send

An SPF record lists the services allowed to send email for your domain, such as Microsoft 365, Google Workspace or your booking system. It should end in -all or ~all. A record ending in +all allows the whole internet, which is worse than none.

DKIM: a signature on every email

DKIM adds a cryptographic signature that proves an email really came from your provider and was not altered. Your email provider gives you the record to add; it only takes a few minutes.

DMARC: what to do with fakes

DMARC tells receiving mail servers what to do with email that fails SPF and DKIM. Start with p=none and a reporting address to see who is sending as you, then move to p=quarantine or p=reject once only your own senders appear.

Even if you never send email

A domain that never sends email should still publish v=spf1 -all and a DMARC policy of reject, so nobody else can use it either.

Questions people ask

What is email spoofing?: Email spoofing is sending an email with a forged From address so it looks like it came from someone else, often a business its recipients trust. It is the basis of most invoice and payment fraud.
How do I stop people spoofing my domain?: Publish SPF, DKIM and DMARC records in your domain’s DNS, then move DMARC to quarantine or reject once you are sure your legitimate senders pass.
Will DMARC stop my own emails arriving?: Not if you start with p=none and watch the reports first. Moving straight to reject without checking can block a forgotten service, such as a booking system, that sends on your behalf.
Does the free check look at my email setup?: Yes. It reads your public SPF, DKIM and DMARC records and includes them in your score.

Check your own site in thirty seconds

Our free, passive scan gives you a security score and grade, checks for the issues on this page, and keeps the details private. If you want them fixed, the Security fix package is a fixed price agreed up front.

Run the free security check About the Security fix