The three records that stop it, the tricks they cannot stop, and how to switch them on safely.
Resources / Can someone send email that looks like it came from my business?
Yes, unless your domain has three records set up and enforced: SPF, DKIM and DMARC. Together they let the receiving mail system check whether an email claiming to be from your address really came from you, and the Australian Signals Directorate recommends all three.1 They are free to set up. What they cannot stop is a lookalike address or a fake display name, so the habits that catch those still matter.
SPF, DKIM and DMARC, all free
Where DMARC needs to end up
What these records cannot stop
Email was designed decades ago with no built-in check on who the sender is. Anyone can write any address in the From line, the same way anyone can write any return address on an envelope. That is what spoofing is: a message that claims to be from you and was never anywhere near your systems.
Receiving mail systems deal with this by checking the sender's domain for published records that say which servers are allowed to send for it and whether the message was signed. If your domain publishes nothing, the receiving system has nothing to check against and has to guess.
Spoofed email from your address is usually aimed at your customers and suppliers: a fake invoice, a request to update bank details, a link to a fake login page. It works because the address looks exactly right.
SPF is a list, published in your domain's DNS, of the services allowed to send email as your domain: Microsoft 365, say, plus your website's contact form and your invoicing software. DKIM adds a digital signature to each message, so the receiver can check it came from you and was not altered on the way.
DMARC ties the two together and tells receivers what to do when a message claiming to be from you fails the checks. It has three settings. p=none means take no action, just report back, which is for testing. p=quarantine means treat failures as suspicious, usually the junk folder. p=reject means refuse them outright.5
Only quarantine and reject actually protect you. A DMARC record left at p=none forever looks like protection in a checklist and stops nothing.
The same records decide whether your own email gets delivered. Since February 2024, Google has required everyone sending to Gmail addresses to have SPF or DKIM set up, and senders of more than 5,000 messages a day to have SPF, DKIM and DMARC.3 Microsoft brought in the same rules for high-volume senders to Outlook.com from 5 May 2025.4
A small business rarely sends 5,000 emails a day, but the direction is clear: mail from domains without proper records is treated with more suspicion every year. When quotes and invoices land in customers' junk folders, missing or broken records are one of the first things to check.
DMARC also gives you something most small businesses never have: a view of who is sending email as you. Its reports list every server that sent mail claiming to be from your domain, so an attempt to impersonate you shows up there, often before a customer mentions it.
DMARC protects your exact domain and nothing else. The standard itself says it does not address visually similar domain names or fake display names.2 So an email from an address one letter off from yours, or from any free email account with your business name typed in as the display name, can still reach your customers.
It also cannot help if a real mailbox is broken into. Email sent from a compromised account is genuinely from your domain and passes every check.
That is why the records are one layer, not the whole answer. The others are multi-factor sign-in on every mailbox, and a rule, for you and your customers, that bank details are never changed on the strength of an email alone.
Start by listing everything that sends email as your domain. Most businesses remember Microsoft 365 or Google Workspace and forget the website contact form, the invoicing or accounting software, the booking system and the newsletter tool. Every one of them needs to be in SPF and, where it supports it, signing with DKIM.
Then publish DMARC at p=none and read the reports for a few weeks. They show every service sending as your domain, including ones you had forgotten. Once everything legitimate passes, move to quarantine, and then to reject. Microsoft's own guidance is to start at none with the goal of reaching reject.5
The two common mistakes are opposite ones. Jumping straight to reject before everything is listed makes your own invoices disappear. Stopping at none and never coming back leaves you exactly as exposed as before.
Our free Email Security Checker looks up your SPF, DKIM and DMARC records and tells you, in plain English, what is set, what is missing and what the DMARC policy is actually doing. Our DNS and Email Configuration Analyser goes into more detail if you want it.
When you check, look past whether a record exists. A DMARC record at p=none, an SPF record with services you stopped using years ago, or two SPF records instead of one, which breaks SPF entirely, all look fine at a glance and protect very little.
If your records are missing, or DMARC has been sitting at p=none since someone set it up years ago, that is worth an afternoon. It is one of the few security improvements that costs nothing to run once it is done.
Free Email Security Checker: See your SPF, DKIM and DMARC status in a few seconds.
Someone is impersonating my business online. What can I do?: When the fake is a lookalike address, page or website rather than your exact domain.
The invoice arrived with new bank details. Is it a scam?: What these records cannot stop, and the two-minute check that does.
Yes, unless your domain publishes SPF, DKIM and DMARC records and DMARC is set to quarantine or reject. Without them, receiving mail systems have no reliable way to tell a spoofed message from a real one.
SPF lists the services allowed to send email for your domain. DKIM signs each message so it can be checked. DMARC tells receivers what to do with messages that fail those checks, and sends you reports about who is sending as your domain.
No. p=none only asks for reports and takes no action, so spoofed email is still delivered. It is the right place to start while you check every legitimate sender, but the goal is quarantine and then reject.
It can, if you move to quarantine or reject before every service that sends as your domain is in SPF or signing with DKIM. Start at p=none, use the reports to find everything, then tighten the policy.
No. It only protects your exact domain. It does not stop lookalike domains, fake display names on free email accounts, or email sent from a genuine mailbox that has been broken into.
Send us your domain. We will check your SPF, DKIM and DMARC, list every service that sends as you, and tell you what it takes to get to reject without losing your own email. Free, no obligation.
Prefer to talk? Call (02) 9053 8789.
Belivanis Information Systems