A few months ago, a supplier received an email from “your billing team” asking to change the bank account for an invoice payment. The email came from your domain, with your logo and your signature. It was fake, but nothing in the message gave it away — because nothing stopped anyone from sending email in your name.
That is email spoofing: impersonating your domain. And it has three antidotes called SPF, DKIM and DMARC. They are not optional for a company that emails clients: they are the difference between your domain being a guarantee or a disguise.
The problem: your domain speaks for you
Anyone can set up a mail server so the sender appears to be facturacion@yourcompany.com, with no connection to your company. You do not see it, but the damage is threefold:
- Your client trusts it. The domain name is your company's seal; if it is yours, it is credible.
- Your reputation burns. The fraud carries your name, even if you never sent it.
- Your legitimate emails land in spam. When your domain is used for fraud, filters start distrusting your domain, and your invoices, quotes and notices stop arriving.
SPF: the guest list
SPF (Sender Policy Framework) is a DNS record that answers a very specific question: which servers are allowed to send email in this domain's name?
When someone receives your email, they check whether the server it came from is on your list. If it is not, the message scores as suspicious. The analogy is simple: it is the doorman's list; whoever is not on it does not get in.
Detail to watch: if you use several providers to send email (your office, your CRM, your newsletter tool), all of them must be on the list. This is the usual cause of “I set up SPF and my emails stopped being delivered”. And SPF only covers the sending channel: it does not protect what the user sees as the visible sender — that is what DMARC is for.
DKIM: the cryptographic seal
DKIM (DomainKeys Identified Mail) is a seal attached to every email that the recipient can verify. If anyone modifies the message along the way — even a single character — the seal breaks during verification.
You configure it in your email provider's console (Google Workspace, Microsoft 365, your host…) and it publishes a public key in your DNS. You do not see it; the recipient's filter does, and it scores your message better. It is also the mechanism that makes your email “authentic” even when it is forwarded or passes through several hops.
DMARC: the rules and the penalties
DMARC (Domain-based Message Authentication) is the missing piece: it tells the recipient what to do when an email using your domain fails the SPF or DKIM checks.
- p=none: do nothing, just report back to me. The recommended learning mode when starting.
- p=quarantine: send it to the spam folder.
- p=reject: reject it outright. The end state you want to reach.
On top of that, DMARC sends you reports: who is sending email in your name, from where, and whether it passes the checks. That serves both to detect active spoofing and to discover the forgotten tool nobody remembered. It is the visibility you do not have today.
Where to start (without breaking your email)
- Inventory: list everyone who sends email with your domain: people, CRM, billing, newsletters, the website.
- Publish SPF with all the real providers.
- Enable DKIM at each provider (it generates the keys; they go into DNS).
- Publish DMARC at p=none and collect reports for a few weeks.
- Read the reports: spot legitimate senders you did not know about and spoofing attempts.
- Raise the policy to quarantine and then to reject. Do it knowing who sends for you: do not raise it before completing the inventory.
How to tell if you are already being spoofed
- By reading headers of a suspicious email: you will see whether it really left your servers. Sometimes that is enough to realise it is not a problem with your own team.
- Through DMARC reports: if someone is sending as you from another infrastructure, it will appear there with their IP.
- With public tools such as MXToolbox: they show in seconds whether your domain has SPF, DKIM and DMARC properly published.
Not just security: deliverability too
Since 2024, the big providers (Gmail, Yahoo) require DMARC from anyone sending email at scale. Without a DMARC policy, your newsletters and commercial emails can land straight in spam or be rejected. Configuring it well does not just protect you from spoofing: it gets your legitimate emails delivered.
If you are not sure where to start, this is one of the checks in our free OSINT audit: we review your email configuration, your subdomains and your public exposure, and deliver it in a report within 72 hours.