If a criminal can send an email that looks exactly like it came from your managing director, your business has a problem. This is not about a 'look-alike' domain where they swap an 'o' for a '0'. This is direct impersonation, where the sender address in the recipient's inbox is your actual, legitimate domain.
Domain spoofing is the engine behind invoice fraud and business email compromise. It works because the basic protocol for sending email (SMTP) was designed in an era when everyone on the internet trusted each other. It has no built-in way to prove that the person sending a message is who they say they are. To fix this, we use three specific layers of verification. If you want to check if your domain can be spoofed, you need to understand how these layers interact.
What domain authentication actually means
When we talk about stopping spoofing, we are really talking about three DNS (Domain Name System) records. Think of DNS as the public phonebook for your domain. By adding specific instructions to this phonebook, you tell the rest of the world how to verify your mail.
First is SPF (Sender Policy Framework). This is essentially a 'guest list' for your domain. It tells the world: "Only these specific servers are allowed to send email on my behalf." If your business uses Microsoft 365, your SPF record will include a specific address for Microsoft. If you also use a marketing tool like Mailchimp, that needs to be on the list too.
Second is DKIM (DomainKeys Identified Mail). This is a digital wax seal. Your mail server signs every outgoing email with a private cryptographic key. The recipient's server looks up your public key in your DNS records to verify the signature. If the email was tampered with in transit, the seal is broken.
Third is DMARC (Domain-based Message Authentication, Reporting, and Conformance). This is the instruction manual. It tells the receiving server what to do if the SPF or DKIM checks fail. Without DMARC, the other two are just suggestions. DMARC turns them into a policy.
The commercial cost of a forged email
For a UK SME, the risk is rarely about data theft in the traditional sense; it is about financial theft. We see two primary patterns.
The first is invoice fraud. A criminal spoofs the domain of a supplier you trust, or spoofs your own finance department to a client. They send a genuine-looking invoice with 'updated' bank details. Because the email comes from your legitimate domain, it bypasses many basic spam filters. The recipient pays the wrong account, and by the time the error is spotted, the money is gone. Recovering these funds is notoriously difficult and often involves the Financial Ombudsman or lengthy legal disputes.
The second is reputational damage. If your domain is used to send thousands of spam emails, your 'domain reputation' will tank. Major providers like Gmail and Outlook will start marking your legitimate business emails as spam. We have seen businesses struggle to send even basic quotes to clients because their domain was flagged for spoofing months prior.
Furthermore, if you are looking to achieve Cyber Essentials certification, having these records correctly configured is no longer optional. It is a core requirement for passing the audit and demonstrating to your insurers and partners that you take digital security seriously.
How to read your domain security audit results
When you run a domain security audit, you will likely see a series of technical strings. Understanding what these mean is the difference between being protected and being vulnerable.
SPF: The guest list check
A 'pass' here means the sending server was authorised. However, look closely at the end of the record. If it ends in ?all or ~all, it is a 'soft fail'. This tells the receiving server: "If it is not on the list, let it through anyway but maybe mark it as suspicious." To stop spoofing, you eventually want this to end in -all (a hard fail), which tells servers to reject unauthorised mail entirely.
DKIM: The signature check
If DKIM is missing, your email has no proof of integrity. Most modern email platforms like Microsoft 365 or Google Workspace generate these keys for you, but you must manually add them to your DNS provider (like GoDaddy, 123 Reg, or IONOS). A common mistake is setting up DKIM for your main mail but forgetting it for your CRM or accounting software.
DMARC: The policy check
This is where most businesses fail. A DMARC record has three main 'policy' states:
- p=none: This is 'monitoring mode'. It tells the world: "If the checks fail, do nothing, but send me a report." It offers zero protection against spoofing.
- p=quarantine: This tells the server to put failing emails into the recipient's junk folder.
- p=reject: This is the goal. It tells the server to block the email entirely. The recipient never even sees it.
Experience Signal
A pattern we see on most tenants we take on is that they have SPF and DKIM in place, but their DMARC record is set to 'none'. This means they are effectively watching the attacks happen in their weekly reports but haven't given the receiving servers permission to actually block the forged messages.
A step-by-step walkthrough to verify your domain
Checking your status does not require you to be a senior engineer. You can follow this process to get a clear picture of your current stance.
- Run an automated check: Use our free domain security audit. It will query your public DNS records and tell you exactly what is visible to the outside world. This is the same view a hacker has when they are scouting for targets.
- Check for multiple SPF records: A domain can only have one SPF record. If you have two (perhaps one for Microsoft and one for an old web host), they will both fail. You must merge them into a single line.
- Verify the 'include' count: SPF records have a limit of 10 'lookups'. If you use too many third-party services (Salesforce, Zendesk, Xero, Mailchimp), your record might become too complex and break. This is a common reason why legitimate mail starts failing.
- Send a test email to a tool: Use a service like Mail-Tester. It provides a one-time email address. You send an email from your work account to that address, and it gives you a 'score' based on how well your SPF, DKIM, and DMARC are working in a real-world scenario.
- Review your DMARC reports: If you have a DMARC record, you should be receiving XML reports. These are unreadable for humans, but tools like Postmark or DMARCian can turn them into charts. These charts show you exactly who is trying to spoof your domain and from which countries.
Common pitfalls in domain configuration
In our daily work, we see the same three errors repeatedly. Avoiding these will put you ahead of most UK SMEs.
- The 'Set and Forget' mistake: Businesses often set up SPF when they first get Microsoft 365, but then add a new marketing platform or a new HR system and forget to update the record. Suddenly, their most important emails are being blocked.
- The DNS Provider lag: When you update a DNS record, it can take up to 48 hours to 'propagate' across the internet. We often see people panic and revert their changes because they don't see an immediate result. Patience is a technical requirement here.
- Syntax errors: A single missing semicolon or an extra space in a TXT record will invalidate the entire thing. DNS is extremely literal. If the record is
v=spf1 include:spf.protection.outlook.com -all, but you typev=spf1include..., it simply won't work.
The regulatory and compliance angle
While domain spoofing is a security issue, it is also a GDPR and compliance issue. If a criminal spoofs your domain to successfully phish a client and steal their personal data or payment details, the ICO may look at whether you took 'appropriate technical and organisational measures' to prevent it.
Implementing DMARC at a 'reject' policy is a clear, industry-standard technical measure. If you haven't done it, you are leaving your business open to the argument that you were negligent in your duty to protect the communications channel between you and your customers.
How Black Sheep Support helps
We don't just tell you that your domain is vulnerable; we fix it and monitor it. Domain security is a moving target, and as your business grows, your email ecosystem becomes more complex.
If you are worried that your domain is currently being used to defraud your customers or staff
and we will help you map out a path to a 'p=reject' DMARC policy without blocking your legitimate mail.
Not ready to talk yet? Run our free IT Health Check to assess your business risk and security posture in minutes, no commitment. We also handle hardware, broadband, mobile and networking, ensuring your entire infrastructure is as secure as your email.
FAQ
Can I just set DMARC to 'reject' immediately? No. If you have legitimate services sending email (like an old website contact form or a printer in the office) that aren't in your SPF or DKIM, setting DMARC to 'reject' will break them. You should always start at 'p=none', review the reports to find all your legitimate senders, and then move to 'quarantine' and 'reject' once you are certain everything is accounted for.
Does SPF protect me from people using my name? No. SPF, DKIM, and DMARC protect your domain (@yourbusiness.co.uk). They do not stop a criminal from creating a Gmail account with the name 'Your Managing Director' and sending emails from there. This is known as 'display name spoofing', and it requires different protections, such as Microsoft Defender for Office 365.
How much does it cost to fix domain spoofing? If you have an IT partner, the technical changes are usually included in your managed IT support. The DNS records themselves are free to create. The 'cost' is usually the time required to audit your senders and monitor the DMARC reports to ensure you don't block your own invoices by mistake.
Does this stop all phishing? No. It stops people from impersonating your domain. It is one layer of a 'defence in depth' strategy. You still need email filtering to stop phishing coming in from other people's spoofed domains, and you still need MFA (Multi-Factor Authentication) to protect your accounts if a member of staff does click a link.
Want this handled for you? See Cyber security services.
Based in Brighton or Hove? We are too: see IT support in Brighton.
