How email spoofing works, and how DMARC stops it
Why plain email lets anyone forge your From address, the real damage spoofing does to a business, and how a DMARC policy shuts it down at the receiver.
If someone can put your business name in the From line of an email, they can pretend to be you. Plain email was never built to stop that. DMARC is the standard that finally does, and this post explains how the trick works and where DMARC breaks it.
What spoofing actually is
Spoofing is sending an email that shows someone else’s address in the From line. Not a lookalike address, the real one. A scammer can send a message that displays accounts@yourbusiness.com to your customer, even though they have no access to your systems and no password of yours.
The reason is a quirk of how email was designed. The From address you see in your inbox is part of the message content, filled in by whoever sends it. Think of a paper letter: the sender writes the return address on the envelope themselves, and the postal system does not check it. Email works the same way. The sending server does not have to prove that the From address belongs to it.
For decades that was mostly fine, because email traffic was small and trusted. Today it is the single most common way businesses get impersonated.
Why it costs real money
Spoofing is not a theoretical problem. It turns into two very practical kinds of fraud.
The first is invoice fraud, sometimes called business email compromise. A scammer spoofs your accounts address and emails your customer a genuine-looking invoice with their own bank details. The customer has dealt with you before, the address matches, so they pay. The money is gone before anyone notices, and your customer blames you.
The second is brand impersonation. A scammer spoofs your domain to send phishing emails to the public, chasing passwords or card numbers. Your customers get scammed, your domain gets a bad reputation with mail providers, and your genuine mail starts landing in spam as collateral damage.
In both cases the attacker never touched your account. They only borrowed your name, because email let them.
The three records that add proof
Stopping spoofing means giving receivers a way to check that a message really came from you. That is done with three DNS records. DNS is the public address book for your domain, and anyone can read what you publish there.
- SPF (Sender Policy Framework) lists the mail servers allowed to send email for your domain. A receiver checks whether the server that delivered the message is on your list.
- DKIM (DomainKeys Identified Mail) adds a signature to each message, created with a private key that only you hold. The receiver checks it against a public key you publish, which proves the message came from your domain and was not altered on the way.
- DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the first two together, adds a rule for what to do when they fail, and sends you reports.
SPF and DKIM on their own tell a receiver whether a message passed a check. They do not, by themselves, tell the receiver to do anything about a message that fails. That is the gap DMARC fills.
How DMARC shuts spoofing down
Your DMARC record carries a policy, written as a p= tag, that tells receiving servers how to treat mail that claims to be from you but fails the checks:
p=none: change nothing, just send reports. This is monitoring only.p=quarantine: treat failing mail as suspicious, usually sending it to spam.p=reject: refuse the failing mail outright, so it never reaches the inbox.
There is one more piece that makes this trustworthy, called alignment. It is not enough for SPF or DKIM to pass for some domain. The domain that passed has to match the domain your reader actually sees in the From line. A scammer sending from their own server cannot make your domain pass SPF or DKIM, and they cannot forge your DKIM signature, so their message fails. If your policy is p=reject, the receiver throws it away. We go deeper on this in what DMARC alignment really means.
So the forged invoice that would have reached your customer never arrives, because the receiving mail server checked and refused it. That is the whole point of DMARC, and it is why reaching p=reject matters. A policy of p=none sees the problem but does nothing about it.
What DMARC does not fix
It is worth being honest about the edges. DMARC protects the exact domain in the visible From address. It does not stop a scammer registering a lookalike domain like yourbusiness-invoices.com and spoofing that instead, because that domain is not yours to protect. It also depends on the receiving provider honoring your policy, though most large providers do.
And there is a catch on your own side. DMARC cannot tell your genuine mail from a forgery on its own. It only knows what passes the checks. If you move straight to p=reject before your own mail, including newsletters, payroll systems and booking tools, is properly authenticated, you can block your own messages. That is why you always measure before you enforce, which is the subject of the path to p=reject.
Where to start
If you want to see whether your domain is currently exposed, run the free DMARC checker. It analyzes your live records and tells you, in plain language, whether someone could spoof you today. To understand the mechanics in full, read what is DMARC. Getting to p=reject is the goal, and it is more manageable than it sounds once you can see what your mail is actually doing.