Free guide

How to stop someone spoofing your email domain

Customers getting emails “from you” that you never sent? How to confirm it’s spoofing, lock your domain down with SPF, DKIM and DMARC, and warn clients.

Email spoofing means someone sends a message with your domain in the From line without access to your systems. Without DMARC enforcement, receivers have no instruction to reject it.

1. Spoofed or hacked?

  • Spoofed: the message is not in your Sent items; headers usually show SPF/DMARC fail or come from an unrelated server.
  • Hacked: messages appear in your Sent folder, rules forward your mail, or replies come to you. Reset passwords, turn on MFA, remove unknown inbox rules and tell your IT provider.
  • Lookalike: the domain is slightly different (yourbusines.com, yourbusiness.co). See lookalike domain examples.

2. Lock the domain down

  1. Check your current records with our free scan.
  2. SPF: one record, listing every legitimate sender, ending -all or ~all.
  3. DKIM: enable signing in Microsoft 365, Google Workspace and each tool that sends for you.
  4. DMARC: start at p=none, then enforce. Read what is DMARC.
  5. Domains that never send email: publish v=spf1 -all and p=reject so they can’t be abused (NCSC).

3. Protect customers

Spoofed invoices are a form of business email compromise, which the FBI tracked at over US$43B in exposed losses worldwide between June 2016 and December 2021 (FBI IC3 PSA). Tell clients you will never change bank details by email and that they should call you on a known number to confirm. Our payment verification policy gives you a ready-made template.

Questions

Can I stop spoofing completely?

DMARC at p=reject stops exact-domain spoofing at receivers that honour it, which includes Gmail, Yahoo and Outlook.com. It cannot stop lookalike domains, so monitor those too.

Has my email account been hacked?

Not necessarily. Spoofing forges the From line without touching your account. If the messages appear in your Sent folder, or replies arrive in your inbox, treat it as a compromised account and reset passwords and MFA.

Check your domain in 30 seconds

Our free scan reads your SPF, DMARC, DKIM and MX records and checks about 50 lookalike variants of your domain. No signup needed for the summary.

Scan my domain freeEmail & domain protection

More guides

General information only, not legal or financial advice. ImposterWatch is operated by Cloud Investments FZE (UAE) and is not a background check or private investigator service.