How email spoofing works
Email has no built-in proof of who sent a message. The From address you see in your inbox is just a line of text the sender chose, much like the return address on an envelope. A scammer can write [email protected] there as easily as their own address, and a receiving mail server has no way to tell the difference unless your domain publishes rules for checking it.
Those rules are SPF, DKIM and DMARC. SPF lists the servers allowed to send for your domain, DKIM adds a cryptographic signature to each message, and DMARC tells receivers what to do when a message using your domain in the From address fails both: deliver it anyway, send it to spam, or reject it. Without a DMARC policy that says "reject", forged mail in your name can land in inboxes.
Spoofed mail is used for invoice fraud, fake password resets and phishing that borrows your brand's trust. It also hurts your own deliverability: when mailbox providers see lots of junk claiming to be you, your real mail suffers.
Why p=none doesn't protect you
Many domains have a DMARC record with p=none. That policy means "monitor only": receivers send you reports about mail
that failed, but they still deliver it. It's the right first step, because the reports show you every service that sends as your
domain, but it gives no protection. A domain with p=none is as spoofable as one with no DMARC at all.
p=quarantine sends failing mail to spam, which helps but still puts the forgery in front of the recipient. p=reject is the setting that actually stops it. Watch out for pct below 100, which applies the policy to only
part of the failing mail, and for sp=none, which leaves every subdomain (billing.yourcompany.com, say) open even when the
main domain is protected.
Why SPF alone isn't enough
SPF checks the envelope sender, a hidden address used for bounces, not the From address people read. A spammer can send from their own domain, pass SPF for it, and still put your domain in the visible From line. Only DMARC connects the two, by requiring that the domain which passed SPF or DKIM matches the From address. That's why this check gives its verdict from DMARC and lists SPF as supporting detail. Read more about SPF and DMARC.
Getting to p=reject without blocking your own mail
Jumping straight to reject can block your own newsletters, invoices or helpdesk mail if one of those services isn't set up for SPF or DKIM. The safe route takes a few weeks:
- Publish
p=nonewith aruaaddress so you receive aggregate reports. - Read the reports with the DMARC report analyzer and fix SPF or DKIM for every legitimate sender that fails.
- Move to
p=quarantine, starting withpct=25and raising it as reports stay clean. - Switch to
p=rejectand make sure subdomains are covered too.
The check above always suggests the next step from where you are now, with the exact record to publish, keeping your existing report addresses.
FAQ
- What is email spoofing?
- Sending email with a forged From address, so the message looks like it comes from your domain. Email was designed without sender checks, so anyone can type any From address unless the domain publishes a DMARC policy that tells receivers to reject forged mail.
- How do I stop people spoofing my domain?
- Publish a DMARC record and move it step by step from p=none to p=quarantine to p=reject. Make sure SPF and DKIM pass for every service that sends mail for you first, or your own mail gets blocked too.
- Does SPF stop spoofing?
- Not on its own. SPF checks the hidden envelope sender (Return-Path), not the From address people see. A spammer can pass SPF with their own domain and still show yours in From. DMARC is what ties the visible From address to SPF and DKIM.
- My domain doesn't send email. Can it still be spoofed?
- Yes, and unused domains are a favourite target because nobody watches them. Lock them down with "v=spf1 -all", a DMARC record with p=reject, and a null MX record. Turn off "This domain sends email" in the form to get exactly those records.
- Is this check enough to know I'm safe?
- It tells you whether receivers that follow DMARC will reject mail forged in your exact domain. It doesn't cover lookalike domains (examp1e.com), display-name tricks, or receivers that ignore DMARC.