Imagine your customers receiving a convincing email from [email protected] — except you didn't send it. A scammer did, impersonating your domain to steal passwords or payments. That's domain spoofing, and the damage lands on your reputation. The good news: it's largely preventable with the right setup.
What domain spoofing is
Domain spoofing is forging the sender so a message appears to come from a domain it didn't. Email was designed in a trusting era where anyone can claim to be anyone in the "From" field — so without protection, a scammer can send mail as [email protected] and it looks legitimate.
It comes in a few flavours:
| Type | What's faked |
|---|---|
| Email spoofing | The "From" address of an email |
| Lookalike domains | A similar domain (yourc0mpany.com) |
| Display-name spoofing | A real name with a fake/hidden address |
The most damaging is exact-domain spoofing — using your actual domain — because it's the hardest for recipients to catch.
Why it's so harmful
- Phishing your customers — they trust the name, hand over credentials or money.
- Reputation damage — recipients blame you for the scam mail.
- Deliverability fallout — spoofing abuse can hurt your domain's sending reputation and even get you blacklisted.
How to prevent exact-domain spoofing
The defence is email authentication — DNS records that let receiving servers verify mail really came from you, and reject it if not. This is exactly what SPF, DKIM and DMARC do:
| Record | Its job against spoofing |
|---|---|
| SPF | Lists which servers may send for your domain |
| DKIM | Signs your mail so tampering/forgery is detectable |
| DMARC | Tells receivers to reject mail that fails — and reports spoof attempts |
DMARC at
p=rejectis the key. SPF and DKIM let receivers detect a spoof; DMARC with arejectpolicy tells them to actually block it — turning "this might be fake" into "this gets refused." Without an enforcing DMARC policy, exact-domain spoofing largely succeeds.
The path: deploy SPF, DKIM and DMARC, start DMARC at p=none to monitor, then tighten to quarantine and finally reject.
What it doesn't stop (and what helps)
Authentication stops spoofing of your exact domain — but not lookalike domains (yourc0mpany.com), which pass their own checks. For those:
- Register common lookalikes and typo variants of your domain.
- Monitor for newly-registered lookalike domains.
- Educate customers that you'll only ever email from your real domain.
- Consider BIMI (which can display your verified logo in inboxes) once DMARC is enforced — a visible trust signal.
A monitoring connection
Your email authentication can silently break — a DNS change drops an SPF record, a DKIM key rotates. Since the failure is invisible until mail starts bouncing or spoofing succeeds, monitoring your email policy records (SPF/DKIM/DMARC) catches drift before attackers (or your own broken mail) exploit it.
The bottom line
| In one line | |
|---|---|
| What | Forging your domain as the sender of email. |
| Harm | Phishes customers, wrecks reputation and deliverability. |
| Prevent | SPF + DKIM + DMARC, with DMARC at p=reject. |
| Also | Watch for lookalike domains; monitor your records. |
Domain spoofing weaponises your own good name against your customers — but exact-domain spoofing is stoppable. Authenticate your mail and enforce DMARC, watch for lookalikes, and the scammers lose their easiest disguise.
Related: SPF, DKIM & DMARC, email blacklists; check your records with the free SPF, DKIM and DMARC tools.