Can someone send email pretending to be you?

How email spoofing works

Email was designed without any check on who the sender is. The From address is just text the sending program writes, the same way you can write any return address on an envelope. Spoofers use this to send fake invoices, payment-change requests and password resets that look like they come from you, to your customers, suppliers and staff.

Three DNS records let receiving servers tell real mail from fake:

• SPF lists the servers allowed to send for your domain.
• DKIM signs each message so it can't be forged or altered.
• DMARC ties both to the visible From address and tells receivers to reject mail that fails.

How to tell if your domain can be spoofed

Your exact domain is protected only when all of these are true:

1. You publish an SPF record that doesn't end in +all.
2. Your mail is DKIM-signed with your own domain.
3. You publish a DMARC record with p=quarantine or p=reject.

If DMARC is missing or set to p=none, receivers have no instruction to stop fake mail from your domain, even if SPF and DKIM are perfect. That is the single most common gap we find, and the free check above shows you in seconds whether you have it.

Fixing it, in order

1. Inventory your senders: your mailbox provider and every tool that emails as you.
2. Publish or tidy SPF so it lists only those services, in one record.
3. Turn on DKIM in Microsoft 365 or Google Workspace, and in each other tool.
4. Add DMARC at p=none with a reporting address, and watch the reports for a few weeks.
5. Enforce: move to p=quarantine, then p=reject.

Subdomains matter too. A spoofer can use billing.example.com if your policy doesn't cover it; DMARC applies your policy to subdomains unless you set a weaker sp= value.

Domains you don't send email from

Spare and parked domains are favourite spoofing targets because nobody watches them. Lock each one down with three records: SPF v=spf1 -all, DMARC v=DMARC1; p=reject, and a null MX record (MX 0 .) to say the domain receives no mail.

What these records can't stop

• Lookalike domains such as examp1e.com or example-billing.com, which criminals register themselves.
• Display-name tricks: a free webmail account named "Example Accounts".
• A real mailbox that's been taken over, which sends genuinely authenticated mail. Multi-factor authentication is the defence there.

The free check reads only your public DNS records. It doesn't send test emails or touch your mail servers.