How to stop email spoofing on your business domain

If a customer forwarded you an invoice "from you" that you never sent, or your inbox is suddenly full of bounce-backs for messages you didn't write, someone is probably spoofing your business email. It's unsettling, but it's also one of the most fixable problems in small business security.

The fix lives in your domain's DNS settings, the same place your website address is managed. You don't need special software. You need three short records and a little patience while you confirm everything works.

What is email spoofing, in plain English?

Email spoofing is when someone sends a message that claims to be from your address, like billing@yourbusiness.com, without ever touching your account. Email was designed in a more trusting era, so the From line is a bit like the return address on an envelope. Anyone can write anything there.

Scammers use this for phishing and business email compromise: fake invoices, "updated" bank details, or urgent requests that look like they came from you or your boss. Your mailbox is usually fine. It's your name that's being borrowed.

Email providers can check whether a message really came from you, but only if you publish the information they need to check against. The rest of this guide sets that up.

Start by writing down every address your business uses (info@, billing@, your own) so you know which ones matter most.

How can you tell someone is spoofing your email?

You often find out from other people before you see any technical evidence. Common signs include:

• You get "Undeliverable" notices for messages you never sent, a classic sign someone is sending spam with your address.
• Customers ask about strange emails: "Did you really change your bank account?" or "Is this invoice legit?"
• Your real email starts landing in spam. When fakes damage your domain's reputation, providers trust your real messages less too.
• A DMARC report shows servers you don't recognize. Once you set up DMARC (Step 4 below), you'll see exactly which servers are sending as you.

If fake emails are going out right now, the FTC recommends reporting it to the FBI at IC3.gov and to the FTC at ReportFraud.ftc.gov, then telling your customers. Send that notice without links so it can't be mistaken for another scam, and remind people you'll never ask for payment changes by email alone.

How do SPF, DKIM and DMARC stop spoofing?

Think of your domain as a private event, and every email as a guest arriving at the door.

• SPF is the guest list. It names the services allowed to send email for you, like Google Workspace or your newsletter tool. If a message arrives from a server that isn't on the list, it looks suspicious. (What is SPF?)
• DKIM is the wax seal. Your email provider stamps each outgoing message with a digital signature. Receivers check the seal against a public key in your DNS to confirm the message is really yours and wasn't changed on the way. (What is DKIM?)
• DMARC is the bouncer's instructions. It tells receivers what to do when a guest isn't on the list and has no valid seal: let them in anyway, send them to the side room (spam), or turn them away. It also sends you reports about who tried to get in. (What is DMARC?)

DMARC adds one important detail. The guest list or the seal has to match the name on the From line, not just some domain hidden in the background. That matching is called alignment, and it's what stops a scammer from passing SPF on their own domain while pretending to be yours.

You need all three working together. SPF or DKIM alone tells providers which messages are yours, but only DMARC tells them to act on fakes.

Run your domain through our free DMARC checker to see which of the three you already have.

Step 1: Who sends email for your business?

Before you publish anything, make a list of every service that sends email using your domain. This is the step people skip, and it's the reason real emails sometimes go to spam later.

• Start with your main mailbox provider (Google Workspace or Microsoft 365).
• Add newsletter and marketing tools, such as Mailchimp, Constant Contact, and similar.
• Check whether your invoicing or accounting software sends from your address.
• Include your website's contact form or online store.
• Look at booking, CRM, and help desk tools too.

Google's own SPF guidance gives the same advice: include every server and service that sends email for your domain. Each of these tools has a help article called something like "authenticate your domain" that lists the records it needs.

Step 2: How do I publish an SPF record?

SPF is one TXT record at the root of your domain (the name is usually @). Your domain can only have one SPF record. If you use several senders, they all go into the same line.

Here are the records you'll end up with by the end of this guide. Use the SPF line that matches your email provider, and replace yourbusiness.com with your own domain.

If you also send through other services, add their include: values before the ~all at the end. For example, Google's help center shows Google Workspace plus Mailchimp as v=spf1 include:_spf.google.com include:servers.mcsv.net ~all. Always confirm the value in each tool's own documentation.

To add or update the record at your DNS host:

After saving, check the result with our free SPF checker. It also counts DNS lookups, since SPF stops working past 10.

Not sure what your domain is missing?

Run a free checkup to see your SPF, DKIM and DMARC status, plus your website basics, in one plain-English report.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

Step 3: How do I turn on DKIM?

DKIM is switched on inside your email provider, which then hands you a record to add at your DNS host. It takes about 15 minutes, plus some waiting.

Google Workspace

1. In the Google Admin console, go to Apps → Google Workspace → Gmail → Authenticate email.
2. Pick your domain and click Generate New Record. Choose a 2048-bit key if your DNS host supports it, and keep the default prefix, google.
3. Copy the record name (google._domainkey) and value, and add them as a TXT record at your DNS host, using the same steps as SPF above.
4. Back in the Admin console, click Start authentication.

Google notes that new Workspace accounts may need to wait 24 to 72 hours after turning on Gmail before a key can be generated, and that DKIM can take up to 48 hours to start working once the record is added.

Microsoft 365

1. In the Microsoft Defender portal, open Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM.
2. Select your domain. Microsoft shows two CNAME records to publish at your DNS host.
3. Add both records, wait a little while, then turn on Sign messages for this domain with DKIM signatures.

To confirm it works, send yourself a test from your business address to a personal Gmail account, open it, and choose Show original. The DKIM line should say PASS.

Step 4: How do I add a DMARC record?

Once SPF and DKIM are in place, give them a day or two to settle. Google recommends waiting 48 hours before adding DMARC. Then add one more TXT record with the name _dmarc:

v=DMARC1; p=none; rua=mailto:dmarc@yourbusiness.com

Here's what each part means:

• v=DMARC1 says "this is a DMARC record."
• p=none means monitoring mode. Providers deliver mail as usual but report what they see.
• rua=mailto:... is where those reports go. Both Google and Microsoft recommend a dedicated mailbox or group rather than your personal inbox, because reports can pile up.

You add it the same way as the SPF record, just with _dmarc as the name. If you use GoDaddy, our step-by-step GoDaddy DMARC guide walks through each screen. Make sure there's only one DMARC record for your domain.

Create the reporting mailbox first (for example, dmarc@yourbusiness.com), then publish the record and confirm it with the DMARC checker.

Step 5: How do I read reports and tighten the policy?

Within a day or two, providers like Google and Microsoft start sending daily summary reports (called aggregate reports) to your rua address. They arrive as compressed XML files, which aren't meant to be read by eye. Free DMARC report viewers can turn them into a simple list of who sent mail as you and whether it passed.

When you review them, you're looking for two things:

1. Your real senders should pass: Google Workspace, your newsletter tool, your invoicing app. If one of them is failing, fix its SPF or DKIM setup before going further.
2. Senders you don't recognize should fail. That's the spoofing you want to block.

After 2 to 4 weeks of clean reports, change p=none to p=quarantine. Fakes now go to spam. Keep watching the reports for a few more weeks, then move to p=reject so fakes are refused outright. Microsoft describes this same gradual path, from none to quarantine to reject, as its recommended approach.

Monitoring mode is a starting line, not a finish line. DMARC only blocks fakes once you move past p=none.

If a real sender breaks after you tighten the policy, you can step back to p=none while you fix it. Nothing is permanent.

Set a calendar reminder for three weeks from today to review your reports and decide whether you're ready for quarantine.

What should you do next?

You don't have to do everything today. A good order is:

1. Check where you stand with our free DMARC checker and SPF checker.
2. If you have no DMARC record yet, follow our fix guide for a missing DMARC policy.
3. For the bigger picture, read SPF, DKIM and DMARC explained, or, if you use Google, the Google Workspace security checklist.
4. Run a free website and email checkup to catch anything else worth fixing.