Can someone send email pretending to be you?

Yes. Unless your domain has three settings called SPF, DKIM and DMARC, anyone can send an email that says it's from you@yourcompany.com, and many inboxes will deliver it. Those three records are short lines of text in your domain's settings, and together they tell the world which mail is really yours and what to do with fakes.

The good news: setting them up is a one-time job, it's free, and you can check where you stand in about ten seconds. Here's what each one does, in plain English.

How does email spoofing work?

Email was designed in a friendlier era. The "From" line on an email is a bit like the return address on an envelope: you can write whatever you want there. Nothing in basic email checks it.

So a scammer can send a message "from" your CEO to your accountant asking for a wire transfer, or "from" your business to your customers asking them to "update their payment details." To the person reading, it looks like you.

Why does email spoofing matter so much?

Because it's how a lot of money gets stolen. The FBI's crime center received 193,407 phishing and spoofing complaints in 2024, more than any other crime type. Business email compromise, the fake boss or fake vendor email asking for money, cost victims $2.77 billion that year. Source: FBI IC3, 2024 Internet Crime Report.

And AI has made fake emails better. In one study, 54% of people clicked links in phishing emails written entirely by AI, the same rate as emails written by human experts, versus 12% for generic phishing. Source: Heiding, Schneier et al., arXiv. The spelling mistakes that used to give scammers away are gone.

Still, plenty of domains have no protection. Only 47.7% of the top 1.8 million domains had a DMARC record in 2025. Source: EasyDMARC, 2025 DMARC Adoption Report. More numbers on our stats page.

What is SPF?

SPF (Sender Policy Framework) is a guest list. It's a line in your domain's DNS (the public settings for your domain name) that lists which mail servers are allowed to send email for you.

When an email arrives claiming to be from your domain, the receiving server checks: "Did this come from a server on the list?"

An example SPF record for a business that uses Google Workspace and one email marketing tool:

yourcompany.com.  TXT  "v=spf1 include:_spf.google.com include:mail.example-newsletter.com -all"

The include: parts add each service you send through. The -all at the end means "anything not on this list is not us." (A softer ~all means "probably not us.")

Two common mistakes: having two separate SPF records (you may only have one), and forgetting a service like your invoicing tool, so its emails start failing.

What is DKIM?

DKIM (DomainKeys Identified Mail) is a wax seal. Your email service signs every message with a secret key, and you publish the matching public key in your DNS. Receiving servers check the seal. If the message was faked or changed on the way, the seal doesn't match.

A DKIM record looks like this (the long value comes from your email provider; this one is a fake placeholder):

google._domainkey.yourcompany.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBg...REDACTED"

The part before ._domainkey is called the selector. Each email service uses its own, so you may have several DKIM records. You don't write these by hand; your email provider's admin panel gives you the exact record to paste.

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the bouncer's instructions. It tells receiving servers what to do with mail that fails SPF and DKIM checks, and where to send reports about it.

Google suggests starting gently. Its setup guide recommends beginning with the policy set to none, which changes nothing about delivery but starts sending you reports. Source: Google Workspace Help, Set up DMARC.

A starter record:

_dmarc.yourcompany.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@yourcompany.com"

Once the reports show your real mail is passing, step up to p=quarantine (send fakes to spam) and finally p=reject (block fakes completely):

_dmarc.yourcompany.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourcompany.com"

Here's the honest catch: p=none only watches. It doesn't stop anyone pretending to be you. The protection kicks in at quarantine or reject.

Do I really need all three?

Yes, they work as a team. SPF checks where mail came from. DKIM checks that it wasn't tampered with. DMARC ties both to the "From" address people actually see, and says what to do when something fails.

There's also a practical reason. Gmail now requires anyone sending more than 5,000 messages a day to Gmail addresses to set up SPF, DKIM and DMARC (a none policy is allowed). Source: Google, Email sender guidelines. Even if you send far less, having them helps your real emails land in the inbox instead of spam.

What about domains that never send email?

Lock them down too. If you own a domain you don't send mail from, scammers can still spoof it. Give it an SPF record of v=spf1 -all (nobody may send for this domain) and a DMARC record with p=reject.

What do DMARC reports tell me?

Once your DMARC record has a rua= address, mail providers start sending you daily reports. They're written for computers (XML files), so they look like gibberish at first. What they boil down to is a list: "We got this many emails claiming to be you, from these servers, and this many passed or failed."

That list is gold. It shows you every service sending as your domain, including ones you forgot about, like the old newsletter tool or the invoicing app. It also shows strangers sending as you. Free and paid DMARC report readers turn the files into a simple table. Use one for a couple of weeks before you switch to quarantine or reject, so you don't accidentally block your own invoices.

How do I check if my domain is protected?

Use our free Email Spoof Check. Type your domain and it looks up your SPF, DKIM (it tries the common selectors) and DMARC records, gives you an A–F grade, and shows the records you need to fix anything missing. It's free and needs no signup.

Your five-minute fix

1. Check your grade. Run your domain through the Email Spoof Check.
2. Fix SPF. Make sure you have exactly one SPF record that lists every service you send mail through.
3. Turn on DKIM in each email service's admin panel and paste the record it gives you into your DNS.
4. Add a DMARC record starting at p=none with a reports address, then plan to move to quarantine and reject within a few weeks.
5. Protect your parked domains with v=spf1 -all and a p=reject DMARC record.

Next up: if AI tools read your email, read Is it safe to give an AI agent your email?, and learn why hidden text in emails matters in What is prompt injection?