Stop Scammers From Sending Emails in Your Company's Name
Right now, with no hacking required, someone could send an email that appears to come from your business. They put your domain in the “From” line, paste in your logo, and ask one of your clients to pay a fake invoice or update their banking details.
This is called email spoofing, and it is one of the most common ways fraud against clients and suppliers begins. The good news is that there are three settings you can add to your domain that make this much harder to pull off — they’re called SPF, DKIM, and DMARC.
This article explains what each one does, the setting most businesses get wrong, and how to check your own domain.
Why Scammers Can Send Email in Your Company's Name
Email was built in a more trusting time. The system that delivers mail does not, on its own, check that the sender is who they claim to be. The From address on an email is about as trustworthy as the return address handwritten on an envelope.
Anyone can write anything there, and the mail still gets delivered. Spoofing takes advantage of that. A scammer puts your domain in the From field, sends the message, and unless your domain is set up to prevent it, the receiving mail server has no reason to question it. The message lands in your client’s inbox looking like it came from you.
The Three Records That Stop Email Spoofing
Three DNS records work together to prove an email really came from your domain. You add them once, at your domain registrar or DNS host, and receiving mail servers check them on every message you send.
SPF (Sender Policy Framework)
SPF is a list of the mail servers allowed to send email for your domain, published as a DNS record. When a receiving server gets a message claiming to be from you, it checks whether the sending server is on that list. If a server that isn’t on the list tries to send as your domain, SPF flags it.
DKIM (DomainKeys Identified Mail)
DKIM adds a tamper-proof signature to every message you send. Your mail server signs outgoing email with a private key, and the matching public key sits in your DNS. The receiving server checks the signature to confirm two things: the message really came from your domain, and nobody
altered it along the way.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC ties the other two together and tells receiving servers what to do when a message fails the check. It also confirms that the domain in the visible From address matches the domain SPF and DKIM verified — which is the part that stops someone forging your exact address. And it sends you reports showing who is sending email using your domain, including the senders who shouldn’t be.
The DMARC Setting Most Businesses Get Wrong
DMARC has three policy settings, and choosing the wrong one is a common mistake. p=none tells receiving servers to do nothing when a message fails. It only monitors and sends you reports.
Your domain can still be spoofed. p=quarantine tells receiving servers to send failing messages to the junk folder. p=reject tells them to block failing messages before they ever arrive. A lot of businesses set up DMARC at p=none, watch the reports come in, and never move past it. At p=none, you get reports but your domain still isn’t protected. Real protection only starts at quarantine or reject.
At iQtec, when we review a client’s email configuration, this is one of the most common gaps we find — DMARC is present, but set to monitor-only, which means spoofed emails can still get through.
What SPF, DKIM and DMARC Don't Stop
These records stop someone from forging your exact domain. There are two things they don’t catch, though, and both are worth knowing about.
Lookalike domains. A scammer can register a domain that resembles yours — like yourcompany-invoices.com or yourcompany.co instead of .com — and send from that. Your records protect your real domain, not a different one the attacker owns.
Display-name spoofing. The name shown in the From line can read “Your Company Accounts” while the real address behind it is a random Gmail account. DMARC checks the domain, not the display name. For those, you still need the habits that catch any phishing attempt: check the full email address rather than just the display name, and verify any request to change payment details by calling a known number — not one from the email.
Why This Matters Even if You Don't Send Many Emails
There are two reasons every business should care about this — not just high-volume senders.
The first is protection. These records stop scammers from impersonating your domain to your clients, your suppliers, and your own staff.
The second is deliverability. The major mailbox providers now require these records from anyone sending in volume. Since February 2024, Google and Yahoo have required bulk senders — those sending more than 5,000 messages a day — to use SPF, DKIM and DMARC.
Microsoft began applying similar requirements to Outlook.com and Hotmail in 2025, routing non-compliant high-volume mail to junk and then rejecting it. Even below those thresholds, a domain with proper authentication is more likely to reach the inbox than the spam folder.
How to Check and Fix Your Domain
You can get a rough sense of where you stand without any technical work. Several free DMARC and SPF checkers let you type in your domain and see which records exist. That tells you whether the records are present, though not whether they’re configured correctly.
Fixing them properly is a job for your IT provider or whoever manages your domain. The records live in your DNS, and a mistake can send your own legitimate email to spam, so the rollout is done in stages:
- Publish SPF and DKIM so all of your real mail sources are covered. Then add DMARC at
p=noneand read the reports to confirm your legitimate mail passes. - Move DMARC to
p=quarantine, then top=reject, once the reports look clean. - Have your IT team verify the configuration is correct end-to-end — not just present.
At iQtec, email authentication review is part of how we assess a client’s broader cybersecurity posture. If you’d like to know where your domain stands, we’re happy to take a look.
What to Do Next
- Run a free domain check — Search “DMARC checker” or “SPF lookup” and enter your domain to see what’s currently published
- Talk to your IT provider — Ask them to confirm your SPF, DKIM and DMARC records are present and correctly configured.
- Check your DMARC policy — If it’s set to
p=none, ask your provider to plan the move top=quarantineorp=reject.
- Train your team — Remind staff to verify the full email address on any payment-related request, not just the display name.
Email spoofing is one of the more preventable cyber risks a business faces — and one of the more frequently overlooked. The technical fix is straightforward, but it has to be done correctly and taken all the way through. A DMARC record sitting on p=none is not protection. It’s just a monitoring tool.
If you want confidence that your domain is properly locked down, iQtec’s cybersecurity team can assess your current configuration and help you close the gaps — without disrupting your day-to-day email.
Get in touch and speak with the iQtec team today.
FAQs
What is email spoofing?
Email spoofing is when someone sends a message with your domain in the From address to make it look like it came from your company. It’s used to trick your clients, suppliers, or staff into paying fake invoices, changing banking details, or handing over information.
What are SPF, DKIM and DMARC in plain terms?
SPF is a list of servers allowed to send email for your domain. DKIM is a signature that proves a message came from you and wasn’t altered. DMARC ties the two together, tells receiving servers to reject messages that fail, and reports who is sending email as your domain.
Does DMARC stop all email impersonation?
No. DMARC stops someone forging your exact domain. It does not stop lookalike domains (like
yourcompany-invoices.com) or display-name spoofing, where the sender’s name says your company but the address behind it is different. Those still need staff awareness and payment-verification habits.
Will setting up DMARC block my own emails?
Not if you roll it out gradually. Starting at
p=none lets you watch the reports and confirm your legitimate mail passes before you move to quarantine and then reject. Skipping straight to reject without checking first is what causes problems.
Do I need these records if I don't send many emails?
Yes. They protect your domain from being spoofed regardless of how much email you send, and they help your messages reach the inbox. Google, Yahoo and Microsoft now expect proper authentication, and mail without it is more likely to be filtered.