Anyone Can Send Email in Your Company’s Name — Unless You Fix These Three Records

Right now, with no special tools, someone could send an email that looks like it came from your company. The From line would show your domain, your logo could be pasted in, and the message could ask a client to pay an invoice or update banking details. It’s called email spoofing, and it’s one of the most common ways fraud against your clients and suppliers begins.

There are three settings you can add to your domain that make this much harder to pull off — SPF, DKIM, and DMARC. Most businesses have one or two of them in place and the third missing, and that gap is usually all it takes to let a spoofed email through. Here’s what each does, the setting most businesses get wrong, and how to check your own domain.

Why scammers can send email in your name

Email was built in a more trusting era. The system that delivers mail doesn’t, on its own, verify that the sender is who they claim to be. The From address is about as trustworthy as the return address handwritten on an envelope — anyone can write anything there, and the mail still gets delivered.

Spoofing exploits exactly that. A scammer puts your domain in the From field, sends the message, and unless your domain is configured to prevent it, the receiving mail server has no reason to question it. The message lands in your client’s inbox looking like it came from you.

The three records that stop it

Three DNS records work together to prove an email genuinely came from your domain. You add them once, at your domain registrar or DNS host, and receiving mail servers check them on every message you send.

SPF (Sender Policy Framework) is a published list of the mail servers allowed to send email for your domain. When a receiving server gets a message claiming to be from you, it checks whether the sending server is on that list. If one that isn’t tries to send as your domain, SPF flags it.

DKIM (DomainKeys Identified Mail) adds a tamper-proof signature to every message. Your mail server signs outgoing email with a private key; the matching public key sits in your DNS. The receiving server checks the signature to confirm the message really came from your domain and wasn’t altered in transit.

DMARC ties the other two together and tells receiving servers what to do when a message fails. It also confirms the domain in the visible From address matches the domain SPF and DKIM verified — the part that stops someone forging your exact address. And it sends you reports showing who’s sending email using your domain, including the senders who shouldn’t be.

The DMARC setting most businesses get wrong

DMARC has three policy settings, and choosing the wrong one is the classic mistake:

1. p=none tells servers to do nothing when a message fails — it only monitors and reports. Your domain can still be spoofed.
2. p=quarantine sends failing messages to the junk folder.
3. p=reject blocks failing messages before they ever arrive.

A lot of businesses set DMARC to p=none, watch the reports roll in, and never move past it. At p=none you get reports but no protection. Real protection only begins at quarantine or reject — Microsoft’s own guidance is to work toward p=reject once you’ve confirmed your legitimate mail passes.

What these records don’t stop

They stop someone forging your exact domain. Two things they don’t catch:

• Lookalike domains. A scammer can register something like yourcompany-invoices.com, or yourcompany.co instead of .com, and send from that. Your records protect your real domain, not one the attacker owns.
• Display-name spoofing. The name shown in the From line can read “Your Company Accounts” while the real address is a random Gmail. DMARC checks the domain, not the display name.

For those, you still need the habits that catch any phishing attempt: read the full email address, not just the display name, and verify any request to change payment details by calling a known number — never one from the email.

Why this matters even if you don’t send bulk email

Two reasons. Protection: these records stop scammers impersonating your domain to your clients, suppliers, and staff. Deliverability: since February 2024, Google and Yahoo have required bulk senders (over 5,000 messages a day) to use SPF, DKIM, and DMARC, and Microsoft began applying similar rules to Outlook.com and Hotmail in 2025. Even below those thresholds, a properly authenticated domain is far more likely to reach the inbox than the spam folder.

How to check and fix your domain

You can get a rough sense of where you stand with no technical work — several free DMARC and SPF checkers let you type in your domain and see which records exist (though not whether they’re configured correctly). Fixing them properly is a job for whoever manages your IT or domain, because the records live in your DNS and a mistake can send your own legitimate email to spam. That’s why the rollout is staged: publish SPF and DKIM covering all your real mail sources; add DMARC at p=none and read the reports to confirm your legitimate mail passes; then move DMARC to p=quarantine, and finally p=reject, once the reports look clean.

Frequently asked questions

What is email spoofing?

When someone sends a message with your domain in the From address to make it look like it came from your company — used to trick clients, suppliers, or staff into paying fake invoices or changing banking details.

What are SPF, DKIM, and DMARC in simple terms?

SPF is a list of servers allowed to send for your domain. DKIM is a signature proving a message came from you and wasn’t altered. DMARC ties the two together, tells servers to reject messages that fail, and reports who’s sending as your domain.

Does DMARC stop all email impersonation?

No. It stops someone forging your exact domain, but not lookalike domains or display-name spoofing. Those still need staff awareness and payment-verification habits.

Will setting up DMARC block my own emails?

Not if you roll it out gradually. Starting at p=none lets you confirm your legitimate mail passes before moving to quarantine and reject. Jumping straight to reject is what causes problems.

Do I need these records if I don’t send many emails?

Yes. They protect your domain from being spoofed regardless of volume, and they help your mail reach the inbox — Google, Yahoo, and Microsoft now expect proper authentication.

If you’re not sure which of the three records your domain is missing, our Toronto cybersecurity support covers email authentication, and our managed IT team can put SPF, DKIM and DMARC in place without breaking your existing mail flow.

Prepared by the EB Solution team — managed IT and email security for businesses across the Greater Toronto Area. Want to know whether your domain is actually protected? We’ll check all three records and fix what’s missing.