Business domains guide
How to stop people spoofing your company email
Exact-domain spoofing is reduced through aligned SPF, DKIM and DMARC. The dependable order is inventory, observe, correct and then enforce.
Inventory every legitimate sender
List the mailbox provider, website forms, ticket system, invoices, accounting tools, newsletters, scanners, monitoring systems and any vendor that sends with your domain in From. Record owners and sample messages so an old service does not silently block enforcement.
Understand the three controls
SPF authorizes servers for an envelope domain. DKIM signs selected message content for a domain. DMARC checks whether a passing SPF or DKIM domain aligns with the visible From address and publishes a receiver policy. The controls work together but solve different problems.
Measure before enforcement
Publish DMARC reporting and study aggregate results. Test representative messages from every real sender, including forwarded and vendor-generated mail. Correct authentication at the source rather than adding every unfamiliar server to SPF.
Move policy in stages
After legitimate mail aligns, increase enforcement from monitoring to quarantine or reject using controlled percentages. Watch delivery, help-desk reports and DMARC data at each step. Keep a written rollback that identifies the exact prior record.
Cover what DMARC cannot stop
Authentication does not block display-name impersonation, a lookalike domain or a compromised real account. Protect important accounts with phishing-resistant sign-in where possible, teach staff to verify unusual requests and monitor domains that resemble the brand.
Action checklist
- List every service that legitimately sends for the domain.
- Collect representative headers and check alignment.
- Move DMARC toward enforcement only after validating real senders.
Questions people ask
Can I publish DMARC reject immediately?
It can block legitimate systems that were never inventoried. Validate real senders and stage enforcement with a rollback plan.
Does DMARC stop every email pretending to be my business?
No. It addresses unauthorized use of the protected From domain, while lookalikes and compromised accounts require other controls.