Email Spoofing Protection: A Practical Guide for Businesses

Email spoofing protection comes down to two layers. The first is technical: publish SPF, DKIM and DMARC records so receiving mail servers can reject messages that falsely use your domain. The second is human and procedural: train staff, verify unusual requests by phone, and protect real mailboxes with strong multi-factor authentication. Either layer alone leaves a gap.

This guide explains what spoofing is, how to configure the records in a safe order, what authentication cannot stop, and how a small or mid-size business in Southern California can keep the work from falling through the cracks.

Securetechie

Keep email spoofing risks in check

Securetechie provides proactive IT management and enterprise-grade cybersecurity for Southern California businesses, including support for compliance needs.

Explore Securetechie services

TL;DR

Spoofing forges the "From" address. SPF, DKIM and DMARC let receiving servers check whether a message really came from your domain.
Start DMARC at p=none, read the reports, fix legitimate senders, then move to p=quarantine and finally p=reject. Jumping straight to reject can block valid mail.
Authentication does not stop look-alike ("cousin") domains or stolen mailbox credentials. Training, call-back verification and phishing-resistant MFA cover those gaps.
Regulated firms (healthcare, law, finance, mortgage) should treat email security as a documented, enforced control, not a one-time setup.

What email spoofing is and why it works
The three records that stop domain spoofing
A safe rollout, step by step
What authentication does not stop
The human layer: verification habits that work
How to check whether an email was spoofed
Settings in Microsoft 365 and Google Workspace
Special considerations for regulated businesses
Our perspective: treat spoofing as an operations problem
Getting help from Secure Techies
FAQ
Sources

What email spoofing is and why it works

Email was designed without a built-in check that the sender's name matches the sender's server. An attacker can type your CEO's name and your own domain into the "From" field, and without authentication a receiving server has little reason to doubt it.

The messages that result usually follow a familiar pattern. The FTC's analysis of impersonation scams describes scammers copying the look of genuine communications from well-known companies or government offices and playing on emotions to push people to act fast. Inside a business, the same tactics show up as:

A "vendor" asking accounts payable to change bank details.
A "manager" asking an assistant to buy gift cards or approve a wire.
A fake "IT notice" asking staff to re-enter their Microsoft 365 or Google Workspace password.
A message that appears to come from your own domain, sent to your own clients.

The last one does the most damage to trust. Even if nobody is defrauded, clients who receive forged mail in your name remember it.

Two terms are often mixed up. Domain spoofing forges your exact domain. Look-alike domains register something similar, such as one letter changed, and are fully authenticated on their own. Authentication records stop the first and do nothing about the second.

The three records that stop domain spoofing

The foundation is email authentication, which helps providers verify that a message really comes from you. Three DNS records do the work.

Record	What it does	Where it is published
SPF	Lists the servers and services allowed to send mail for your domain	DNS TXT record on your domain
DKIM	Adds a cryptographic signature so receivers can confirm the message was not altered and was signed by your domain	DNS TXT record (public key) plus signing enabled at your mail provider
DMARC	Tells receivers what to do when SPF and DKIM fail or do not align, and sends you reports	DNS TXT record at `_dmarc.yourdomain.com`

CISA, in its binding directive on email and web security, treats a DMARC policy of reject as the strongest setting, because unauthenticated mail is blocked before delivery. CISA's guidance also frames these tools as a deterrent that makes unauthorized mail easy to detect, not a total preventative measure. That distinction matters later in this guide.

DMARC alignment, the part most setups miss

Passing SPF or DKIM is not enough on its own. DMARC requires the domain in the visible "From" header to match the domain that SPF or DKIM validated. This is called alignment.

The common failure is a third-party sender. A marketing platform, CRM, billing system or ticketing tool sends mail "from" your domain but signs it with its own. SPF and DKIM pass for the vendor, DMARC fails for you, and once you enforce a strict policy, those messages vanish. Every platform that sends on your behalf has to be configured to sign or send in a way that aligns with your primary domain.

How sender domains align for DMARC

A safe rollout, step by step

DMARC is a phased project, not a switch. CISA's directive describes the sequence that avoids breaking legitimate mail: monitor first, then enforce.

Inventory every sender. List your mail platform (Microsoft 365 or Google Workspace), plus every application that sends email as your domain: newsletters, invoicing, payroll, scheduling, website forms, copiers and scanners, and any line-of-business software. Ask each department, since IT rarely knows them all.
Publish SPF. Include each authorized sender. Keep a single SPF record per domain, and keep it within the DNS lookup limit that SPF imposes, or it will fail intermittently.
Enable DKIM signing. Turn it on in your mail platform and for each third-party sender that supports custom-domain signing.
Publish DMARC at p=none. This is monitoring mode. Nothing is blocked, but you begin receiving aggregate reports that show who is sending as your domain and whether they pass.
Read the reports for several weeks. Fix legitimate sources that fail. Identify and note sources you do not recognize, because those may be the spoofers.
Move to p=quarantine. Failing messages go to junk. Watch for complaints of missing mail.
Move to p=reject. Failing messages are blocked at the receiving server. Keep reviewing reports monthly, since new tools and vendors appear all the time.

The CISA material is blunt about the risk of skipping steps: going directly to reject can block valid client and partner communications. For a mortgage company waiting on borrower documents, or a clinic sending appointment reminders, that is a real operational cost.

If you want help with the record syntax, the SPF & DMARC record generator builds the TXT values for you, and the email header analyzer shows whether a specific message passed SPF, DKIM and DMARC. For a longer walkthrough aimed at smaller organizations, see the DMARC setup guide for small business.

What authentication does not stop

A correct DMARC reject policy closes one door. Attackers have others, and a business in a regulated field should plan for them.

Look-alike domains

An attacker can register a domain one character away from yours and set up perfectly valid SPF, DKIM and DMARC for it. Authentication passes because the domain really is theirs. The defense is human and procedural: staff who check the full sending address, a banner that flags external senders, and a rule that payment changes are confirmed another way.

Compromised real accounts

If an attacker steals an employee's password, the messages are not spoofed at all. They come from your servers, with valid signatures. This is the usual path into business email compromise, and the reason email authentication should be treated as a foundation rather than a complete answer. Our article on business email compromise covers how these cases unfold.

SEC staff, in a risk alert on ransomware, stress controls such as multi-factor authentication and access management, and the SEC has pursued firms whose weak access controls let outsiders take over email accounts. Two of those enforcement orders are public: KMS Financial Services and Voya Financial Advisors. Both turn on the Safeguards Rule, which requires written policies and procedures to protect customer records.

As for the MFA itself, the strongest option is phishing-resistant authentication such as FIDO2 security keys, because approval-prompt MFA can be defeated by fatigue attacks or session hijacking. The same logic applies to payment systems, as payment data security basics show: access controls and enforced policy matter as much as the tools you buy.

Compromised real accounts — overview diagram

Messages that look right but are not

Some fraudulent mail never touches your domain. It impersonates a vendor, a bank or a government agency. Here the checks are behavioral, and they are covered in the next section.

The human layer: verification habits that work

The FTC's guidance for small businesses on phishing is practical. Staff should pause before responding, mention a suspicious message to a co-worker who may have been targeted too, and call the purported client, company or colleague on a phone number they already know. The FTC's consumer alert on a phishing scam gives the same advice for individuals: look up the phone number or website yourself rather than using the contact details in the message.

Turn that advice into written rules:

Payment changes are confirmed by calling a number already on file, never one in the email.
Wire requests above a set amount need a second approver.
Password or MFA prompts reached through an email link are never entered. Staff go to the site directly.
Unexpected urgency from an executive is a reason to verify, not to hurry.

The SEC risk alert also recommends considering phishing exercises so employees learn to identify phishing emails. Regular simulations, followed by short coaching, work better than a once-a-year slideshow. Our guide to employee security awareness training outlines a program, and the phishing email checker is a handy reference for the red flags.

How to check whether an email was spoofed

When a message looks wrong, the header holds the evidence. In most mail clients you can open "View original" or "View message source." Look for these lines:

Authentication-Results. It shows spf=, dkim= and dmarc= results as seen by your receiving server. A fail on DMARC for a message claiming to be from your own domain is a strong sign of spoofing.
Return-Path and From. If they show unrelated domains, alignment may be broken.
Received lines. Read from the bottom up to see the path the message took. An origin that does not match the supposed sender is a warning.

A pass does not prove the message is safe, since a look-alike domain can pass. Use the result together with the content of the request. Pasting the full header into the free header analyzer saves reading raw text.

Settings in Microsoft 365 and Google Workspace

Both platforms support the full set of controls, but defaults vary by plan and tenant age, so verify rather than assume.

DKIM: enable signing for every custom domain you send from, including domains you own but rarely use.
Parked domains: publish a null SPF record and a DMARC reject policy on domains that never send mail. Attackers favor them.
External sender tagging: mark messages from outside the organization so a forged internal name stands out. A transport rule that rejects external mail using your own domain in the From field is a simple supplement, a tactic often discussed by administrators.
Inbound anti-phishing policies: turn on impersonation protection for key executives and finance staff, and for your most frequent partner domains.
MFA for every account: with conditional access or equivalent rules, and phishing-resistant methods for administrators and finance users.

Our five priority controls for Microsoft 365 email security goes deeper on the Microsoft side, and the broader phishing and email security guide covers filtering and user reporting.

Special considerations for regulated businesses

Healthcare practices, law firms, banks, mortgage lenders and broker-dealers handle data that regulators expect them to protect. A forged email that tricks someone into sending a patient record or a borrower file is a data incident as well as a nuisance.

The SEC's staff guidance, in its ransomware risk alert, points to vulnerability scans, timely patching and periodic review of user access, especially for privileged accounts. The point is enforcement: a policy that exists on paper but is not applied does not satisfy an examiner. CISA's phishing guidance maps its mitigations to the Cross-Sector Cybersecurity Performance Goals developed with NIST, which gives any sector a defensible baseline to document against.

In practice, regulated firms should keep written evidence of:

Their DMARC policy and the date each stage was reached.
Monthly review of DMARC reports.
MFA coverage and which accounts use phishing-resistant methods.
Training and simulation dates, with results.
Periodic access reviews for privileged accounts.

Our perspective: treat spoofing as an operations problem

We see the same pattern in small and mid-size organizations. Someone publishes an SPF record years ago, DMARC sits at p=none forever, and nobody reads the reports. The domain looks protected on paper but is not.

The records themselves take hours. The discipline takes months: keeping the sender inventory current when marketing signs up for a new platform, reviewing reports, and moving the policy to enforcement once the data supports it. That is why we handle email security as part of proactive IT management rather than a one-time project. When someone watches DNS, reports and mailbox sign-ins continuously, problems are found before they interrupt the business.

We also push clients to see authentication as the foundation, not the finish. The strongest results come from combining enforced DMARC with MFA, trained staff, and a written call-back rule for money and credentials. Our clients in healthcare, law and finance get the same sequence, with documentation that fits HIPAA, SEC or other compliance requirements they answer to.

— Alex

Getting help from Secure Techies

If you would rather not manage DNS, reports and policy by yourself, Secure Techies handles it as part of managed IT services for businesses across Southern California. Our cybersecurity solutions cover managed endpoint detection, incident response and risk assessment, with 24/7 monitoring and a dedicated local team. Billing is flat-rate and transparent, without long-term contracts. For firms that need to document their controls, our compliance and security audits address HIPAA, GDPR, SEC, SOC 2 and CMMC.

An email spoofing review is a sensible first step: we check your current records, identify unauthorized senders, and map the path to an enforced policy.

FAQ

Can I stop email spoofing completely?

No single control does. Enforced DMARC stops others from sending mail that falsely uses your exact domain, but it does not stop look-alike domains or logins with stolen passwords. Combine authentication with MFA, staff training and a verification rule for payments.

How long does it take to reach a DMARC reject policy?

It depends on how many services send mail as your domain. Plan on a monitoring period of several weeks, then staged changes to quarantine and reject. Rushing the process risks blocking legitimate messages, so let the reports guide the pace.

Is p=none enough?

It is a starting point, not protection. At p=none you receive reports but spoofed mail is still delivered. Only quarantine and reject tell receiving servers to act on failures, with reject the strongest.

What should an employee do after receiving a spoofed message?

Do not click links or open attachments, and report it to IT. If the message asked for money or credentials, confirm by calling a number you already know. The FTC advises telling a co-worker too, since others may have been targeted.