How to Stop Email Spoofing
Spoofing is not a software problem and no filter fixes it. Three DNS records do, and most businesses have never published them.
Read the way an outsider would, from records that are already public.
What You Are Preventing
Three DNS records decide whether this message is refused or delivered. Nothing about the message itself changes.
Please update payment details for future invoices.
deliveredThe message reached the inbox looking like it came from you.
Why Your Spam Filter Cannot Help
It Guards the Wrong Direction
A filter protects mail arriving at your business. Spoofing sends mail to other people using your name.
It Never Passes Through You
The message goes straight to your customer, so nothing you control ever sees it.
You Find Out Last
Usually a phone call asking why the bank details changed. The message was delivered and believed days earlier.
The Three Records That Stop It
SPF, Which Lists Your Senders
The servers allowed to send as your domain, and what to do when a sender is not on the list. Ending it in a hard fail is what makes the list mean something.
DKIM, Which Signs Your Mail
A signature from your mail provider letting a receiving server confirm the message came from you and was not altered.
DMARC, Which Decides the Outcome
It tells receiving servers to reject a message when the first two do not confirm the visible address. Without it, they produce evidence nobody acts on.
The Three Records Together
Why Most Businesses Have None of This
None of it is difficult and all of it is free. The records are text entries in DNS and a competent provider publishes them in under an hour.
It is missing because nothing breaks when it is absent. Email flows perfectly, no error appears, and nobody is prompted. The absence is only visible to someone who looks, and the people who look most reliably are the ones planning to use it.
Where Email Sits in the Whole Picture
Email authentication is one of eight categories. Fixing it well still leaves the other seven unanswered.
Common Questions
No. The records live in DNS, so whoever controls the domain has to publish them. If a web designer or a former provider holds that access, recovering it is the first step and is worth doing regardless.
No, and that is a separate problem. These records protect your exact domain. A domain one character different is a different domain, and stopping it means monitoring for registrations rather than publishing records.
DMARC reports arrive from mail providers worldwide showing every source sending as your domain and whether it passed. That reporting is the main reason to publish the record even before enforcing it.
This checker reads public records only, specifically the DMARC record published in your domain's DNS. Blindspot is not a penetration test. Nothing is logged into, no password is tested, and no network is touched.
Check All Three Records
The full scan reads SPF, DKIM and DMARC together, plus five other categories.
We only read public records. We never touch your computers and we never ask for a password.
Keep Reading
Three places this leads next, depending on what you want to do about it.
- Free ToolFind Out If Your Domain Can Be ForgedCheck whether your domain has a DMARC record and whether its policy blocks forged email. Free business-domain result, with no login or network access.
- Free ToolFind Out Who Can Send Email As Your CompanyCheck your domain's SPF record, terminal policy, and supported DNS lookup count. Get a free result with no login, software, or private network access.
- ExplainerTyposquattingTyposquatting registers domains that resemble yours to intercept traffic or send convincing email. Here is how it works, why a lookalike with a mail server is an attack already underway, and how to check for yours.