Prevent Email Spoofing: What Actually Stops Forged Senders

The call usually comes from a customer’s accounts department: “You sent us new bank details?” You didn’t. Someone sent an email with your domain in the From line, and it was delivered, because your domain had no rule saying it shouldn’t be. That is email spoofing in practice, and most of it is preventable.

Three kinds of forged sender

“Spoofing” covers several different tricks. To prevent email spoofing you first need to know which one you’re facing, because the fixes have nothing in common.

Only the first is something you control directly as the domain owner. The other two can be contained, not eliminated.

Your exact domain: DMARC at reject

SMTP itself never checks who the sender is. Any server can write From: [email protected]. Protection only exists if the receiving server checks what your domain permits:

1. Your SPF record lists which servers may send.
2. DKIM signs every legitimate message.
3. DMARC requires SPF or DKIM to pass for the very domain in the visible From header, and tells receivers what to do if neither does.

Step three closes the gap. SPF and DKIM on their own will happily pass for the attacker’s domain. And while DMARC sits at p=none, you receive reports about the abuse but the forged messages are still delivered.

Checking where any domain stands takes ten seconds:

$ dig +short TXT _dmarc.example.org
$ dig +short TXT example.org | grep spf

If the first query returns nothing, anyone can send as that domain with a decent chance of landing in the inbox.

Domains that never send email

This is where most organisations slip. You have example.com for the business, plus example.co.uk, example.net and two old product domains that only redirect to the website. None of them send mail. That makes them attractive to fraudsters: no rules, and the name is genuine.

Three records lock each of them down:

example.net.                 IN  TXT  "v=spf1 -all"
_dmarc.example.net.          IN  TXT  "v=DMARC1; p=reject; sp=reject"
*._domainkey.example.net.    IN  TXT  "v=DKIM1; p="

Optionally add a null MX record as defined in RFC 7505, which says the domain accepts no mail either:

example.net.                 IN  MX   0 .

IANA configures example.com exactly this way, null MX included:

$ dig +short MX example.com
0 .

Five minutes per domain removes an easy option for attackers.

Lookalike domains: DNS can’t help here

Nothing in your zone can stop examp1e.com or example-invoices.com. Someone else owns those, and they will have perfectly valid SPF and DKIM. The message passes DMARC, just for the wrong domain.

What tends to work:

• Register the obvious variants yourself. The most likely typos and the other major extension. At betadomain a .com costs €14.99 a year and a .net €16.99, which is less than an hour of cleaning up after a single fraud incident.
• Watch new registrations. Several services and feeds flag newly registered domains that resemble your brand.
• Report abuse. For obvious phishing, registrars and hosts usually act quickly. For trademark disputes on generic TLDs there is ICANN’s UDRP procedure; ccTLDs such as .uk have their own dispute policies.

Display names and reply-to tricks

A large share of business email fraud doesn’t forge any domain at all. The message comes from a free webmail account with a display name like “Finance Director, Example Ltd”. On a phone, the name is often all you see. A close relative uses a genuine From address from a compromised supplier account but sets Reply-To to somewhere else.

Process beats technology here:

• An “external sender” banner, which most business mail platforms can add.
• A fixed rule that bank details never change by email alone, only after a call-back to a known number.
• When in doubt, open the raw message and read Authentication-Results.

What success looks like in reports

After moving to p=reject, DMARC reports tend to settle into a pattern. Your own servers appear with hundreds or thousands of messages and pass. Scattered unfamiliar IPs appear with a handful of messages each, fail, disposition reject. Those are forgery attempts being refused. The walkthrough in read DMARC reports explains how to tell the two apart.

Some residual risk remains with receivers that don’t evaluate DMARC. Gmail, Outlook.com and Yahoo do; a small self-hosted server may not.

A side effect: better deliverability

Stopping spoofing almost always means tidying up your legitimate senders too. Newsletters sign with your domain, the helpdesk is in SPF, dead services are gone. Since February 2024 Gmail and Yahoo have required exactly that authentication from bulk senders, so the clean-up usually shows up in inbox placement as well. Once you are at reject, you can also add a brand logo to the inbox with BIMI.

Your next step: list every domain you own, including the unused ones, and query _dmarc for each. If you spot an obvious variant of your name that is still unregistered, run it through the domain search and check the current price list before someone else takes it.