{"id":361723,"date":"2026-08-28T12:36:59","date_gmt":"2026-08-28T12:36:59","guid":{"rendered":"https:\/\/mightyleapeg.com\/blog\/?p=361723"},"modified":"2026-08-28T12:37:51","modified_gmt":"2026-08-28T12:37:51","slug":"stop-email-spoofing-lock-down-domain","status":"publish","type":"post","link":"https:\/\/mightyleapeg.com\/blog\/stop-email-spoofing-lock-down-domain\/","title":{"rendered":"Stop Email Spoofing: Lock Down Your Domain"},"content":{"rendered":"

Summary:<\/strong> You cannot stop every idiot on the internet from trying to impersonate your company, but you can make direct domain spoofing dramatically harder. Proper SPF, DKIM, and DMARC enforcement, combined with sender audits, monitoring, account security, and protection against lookalike domains, can make most basic spoofing attempts fail before they reach the inbox.<\/p>\n

First, understand what email spoofing actually is<\/h2>\n

Email is surprisingly trusting by design.<\/p>\n

An attacker can create a message that claims to come from finance@yourcompany.com, your CEO, your support team, or another address on your domain even though they never logged into your email system.<\/p>\n

That does not necessarily mean your mailbox was hacked.<\/p>\n

It can simply mean someone forged the visible From address.<\/p>\n

This distinction matters because the solution to a compromised mailbox is different from the solution to domain spoofing.<\/p>\n\n\n\n\n\n\n\n\n
Attack<\/th>\nWhat happened<\/th>\nMain defence<\/th>\n<\/tr>\n<\/thead>\n
Domain spoofing<\/td>\nAttacker forged your domain in the From address<\/td>\nSPF, DKIM, DMARC<\/td>\n<\/tr>\n
Display-name spoofing<\/td>\nAttacker used your employee’s name from another address<\/td>\nImpersonation filtering and user awareness<\/td>\n<\/tr>\n
Lookalike domain<\/td>\nAttacker registered a domain similar to yours<\/td>\nDomain monitoring and anti-phishing controls<\/td>\n<\/tr>\n
Mailbox compromise<\/td>\nAttacker gained access to a real account<\/td>\nMFA, account security, session controls<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

SPF, DKIM, and DMARC are extremely important, but they primarily solve the first problem. They do not magically solve every form of impersonation.<\/p>\n

1. SPF tells the world who is allowed to send for your domain<\/h2>\n

SPF, or Sender Policy Framework, is a DNS record that lists the systems authorised to send email on behalf of a domain.<\/p>\n

If your business sends through Google Workspace, Microsoft 365, a CRM, an email marketing platform, your website, a ticketing system, or another application, those sending systems need to be accounted for correctly.<\/p>\n

A typical SPF policy eventually ends with a hard fail:<\/p>\n

v=spf1 include:your-authorised-sender.example -all<\/code><\/p>\n

The important part is -all<\/code>. It says that sources not covered by the policy are not authorised to send for that domain.<\/p>\n

But SPF alone does not solve spoofing.<\/p>\n

SPF checks the technical envelope sender used during email delivery. The address the recipient sees in the From field can still be different. That is one of the reasons DMARC exists.<\/p>\n

Do not blindly keep adding services to SPF<\/h3>\n

Every third-party tool that asks you to add another SPF include should be reviewed.<\/p>\n

Old CRMs, abandoned newsletter platforms, retired servers, and forgotten SaaS tools can remain authorised long after the company stops using them.<\/p>\n

Your SPF record should reflect your current email infrastructure, not the history of every tool your business has ever tested.<\/p>\n

2. DKIM proves that authorised infrastructure signed the message<\/h2>\n

DKIM, or DomainKeys Identified Mail, adds a cryptographic signature to outgoing messages.<\/p>\n

The sending system signs the message using a private key. Your DNS publishes the corresponding public key. The receiving email server can then verify that the signature is valid.<\/p>\n

This gives the recipient another way to determine whether a message claiming a relationship with your domain actually passed through infrastructure authorised to sign for it.<\/p>\n

Use strong DKIM keys, keep selectors documented, remove abandoned selectors, and rotate keys when appropriate.<\/p>\n

More importantly, make sure every important sender is actually signing with your domain rather than relying entirely on the vendor’s domain.<\/p>\n

3. DMARC is where spoofing protection becomes serious<\/h2>\n

DMARC connects the visible From address with SPF and DKIM.<\/p>\n

For DMARC to pass, at least one authentication method must pass and align appropriately with the domain visible to the recipient.<\/p>\n

Then DMARC tells receiving mail systems what you want them to do when authentication fails.<\/p>\n