How to Stop Email Spoofing and Protect Your Brand

Email spoofing is when an attacker forges your domain in the From: address so a message looks like it came from you. The only reliable way to stop it is to publish three DNS records — SPF, DKIM, and DMARC — and then move DMARC to an enforcing policy (p=quarantine or p=reject). Until DMARC reaches enforcement, receivers have no instruction to reject forgeries, and anyone can still send as your domain. This guide walks through all three records and how to get to enforcement without blocking your own mail.

Why spoofing works — and what actually stops it

The classic From: address a reader sees is unauthenticated by default: SMTP was never designed to verify it. Attackers exploit that to impersonate brands in phishing and invoice-fraud campaigns. SPF, DKIM, and DMARC close the gap in layers:

• SPF lists the servers allowed to send for your domain.
• DKIM cryptographically signs each message so tampering and origin can be verified.
• DMARC ties both to the visible From: domain (alignment) and tells receivers what to do when neither aligns.

The first two are prerequisites; DMARC is the record that actually issues the "reject this forgery" instruction. Skipping to DMARC without the other two, or leaving DMARC at p=none, is the most common reason a domain is still spoofable.

Step 1: Publish an SPF record

List every service that legitimately sends mail as your domain — your mailbox provider, marketing platform, help desk, invoicing tool — then publish a single SPF TXT record at your root domain:

v=spf1 include:_spf.google.com include:sendgrid.net -all

• Use include: for each provider (copy the exact value from their docs).
• End with -all (hardfail) once you are confident the list is complete, so unlisted servers are rejected outright.
• Stay under SPF's 10-DNS-lookup limit — each include counts, and exceeding it makes SPF fail with a permerror.

Publish only one SPF record per domain; two SPF records is itself a misconfiguration. Verify with the SPF lookup tool.

Step 2: Set up DKIM signing

Turn on DKIM in each sending platform. The provider generates a key pair, you publish the public key as a TXT record at ._domainkey.yourdomain.com, and the provider signs outgoing mail with the private key.

• Use a 2048-bit RSA key — the current recommendation in RFC 8301 and required by the major mailbox providers.
• Give each sending service its own selector so streams sign independently and you can revoke one without touching the others.
• Confirm the key is live and correctly formatted with the DKIM lookup tool.

Step 3: Deploy DMARC and drive it to enforcement

Publish a DMARC record at _dmarc.yourdomain.com, starting in monitoring mode:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

p=none blocks nothing yet — it asks receivers to send you aggregate reports so you can see every source sending as your domain. Read those reports until every legitimate stream is passing and aligned, then tighten the policy in stages:

1. p=none — observe, fix authentication gaps.
2. p=quarantine — failing mail goes to spam; watch for false positives.
3. p=reject — failing mail is refused outright. This is the only setting that fully stops spoofing.

A domain sitting at p=none is monitored, not protected. Enforcement is the finish line. Check where a domain stands with the DMARC lookup tool.

Why enforcement matters more than ever

Mailbox providers now treat authentication as a requirement, not a nicety:

• Gmail and Yahoo (since February 2024) require domains sending more than 5,000 messages a day to have SPF, DKIM, and DMARC (at least p=none), one-click unsubscribe, and a spam-complaint rate under 0.3%.
• Microsoft applies comparable rules to high-volume senders reaching Outlook.com and Hotmail consumer mailboxes.

Beyond compliance, an enforced DMARC policy is what lets brand features like BIMI display your logo — and what stops attackers from ever spoofing your exact domain again.

Common issues with stopping email spoofing

Why is my own legitimate mail failing DMARC?

Almost always an alignment or missing-source problem. A stream may pass SPF or DKIM but use a different domain in the check than the one in your From:, so it fails alignment. Or a sender you forgot — a CRM, a payroll tool — was never added to SPF or given a DKIM key. Read your aggregate reports, identify the source, and either authenticate it or route it through an authorized path before moving to p=reject.

Why does SPF keep returning a permerror?

You have exceeded the 10-DNS-lookup limit, or you have more than one SPF record on the domain. Each include, a, and mx mechanism costs a lookup. Consolidate providers, remove unused includes, or use SPF flattening, and make sure exactly one v=spf1 record exists.

Attackers are spoofing a lookalike domain, not mine — does DMARC help?

DMARC only protects the exact domain it is published on. A cousin domain like yourdomaìn.com or yourdomain-support.com is a different domain and needs its own defenses: register obvious variants, monitor for new registrations, and use enforcement plus user training. DMARC stops exact-domain spoofing; it cannot police names you do not own.

I set p=reject but forwarded mail is bouncing — what happened?

Forwarding breaks SPF (the forwarder becomes the sender) and can break DKIM if the forwarder rewrites the message. If DKIM survives forwarding intact, DMARC still passes through it, which is why DKIM matters so much. Check the email header of a bounced message to see which check failed, and confirm the forwarding path signs or re-signs correctly.

Frequently asked questions

How long until spoofing actually stops after I publish these records?

SPF and DKIM take effect as soon as DNS propagates (governed by the record TTL, often minutes). But spoofing does not stop until DMARC reaches p=reject. Plan a few weeks at p=none and p=quarantine to catch legitimate senders before you enforce.

Do I need DMARC if I already have SPF and DKIM?

Yes. Without DMARC there is no alignment check tying SPF/DKIM back to the visible From: domain, and no instruction telling receivers to reject forgeries. SPF and DKIM alone leave your domain spoofable.

Will enforcing DMARC hurt my deliverability?

Done in stages, it helps. Rushing to p=reject before every legitimate source authenticates can block your own mail — which is why the none → quarantine → reject ramp exists. Once enforced, a strong DMARC record improves reputation and inbox placement.

Can attackers still impersonate my brand once DMARC is at reject?

Not by spoofing your exact domain — that is blocked. They may switch to lookalike domains or display-name spoofing (using your name with a random address). Combat those with lookalike-domain monitoring and user awareness, since they fall outside what DMARC controls.

Want a hand getting to enforcement without blocking your own mail? Run your domain through the Email Security Score to see exactly which records are missing and what to fix next.

Related reading

• What are DMARC, DKIM, and SPF?
• How to understand DMARC reports
• What is spoofing and how can you stop it?