Email Spoofing Protection: A Practical Guide for Businesse

Email spoofing protection comes down to three layers working together. First, authenticate your own domain with SPF, DKIM and DMARC so nobody can send mail as you. Second, filter and label inbound mail so forged messages never look trustworthy to your staff. Third, put a verification step in front of every payment or credential request, so a convincing fake still fails. Skip any layer and spoofed mail finds the gap.

This guide walks through each layer in plain terms, with the settings to check, the mistakes that trip up growing companies, and what to do the day a spoofed message lands. We run IT for small and mid-sized businesses across West Bend and Southeastern Wisconsin, and the patterns below are the ones we see in the field.

TL;DR

Spoofing forges the sender of a message. It is a technique, and phishing or payment fraud is usually the goal.
Publish SPF, DKIM and DMARC for every domain you own, then move DMARC from monitoring to enforcement once every legitimate sender is accounted for.
Authentication protects your name outside. You also need inbound filtering, external-sender labels and multifactor authentication to protect your people inside.
Confirm every payment change or wire request by phone, using a number you already had, never one from the email.
If money moved, call your bank first, then preserve evidence and check mailbox forwarding rules.

What email spoofing is, and how it differs from phishing
Layer one: authenticate your domain with SPF, DKIM and DMARC
Layer two: filter and label inbound mail
Layer three: train people and verify money requests
Quick comparison: what each control stops
If a spoofed email gets through
Is email spoofing illegal?
Our perspective
How Collett Systems helps
FAQ
Sources

What email spoofing is, and how it differs from phishing

Email spoofing forges sender information, most often the visible From or Reply-To field, so a message appears to come from a person or domain the recipient trusts. Proton explains that phishing is a different thing: it is the social-engineering attempt to get someone to click, disclose information, download malware or send money. Spoofing is one technique that makes phishing believable.

It works because the basic mail protocol was never built to verify senders. Cloudflare's overview notes that SMTP has no built-in way to authenticate addresses, and that the address in the header and the address in the SMTP envelope do not have to match for a message to be delivered. Anyone can type your CEO's name and address into the From line.

The FBI's guidance on spoofing and phishing adds that spoofing is often as simple as changing one letter, symbol or number in an address. That is why two kinds of spoofing matter to a business:

Exact-domain spoofing. The attacker forges your real domain. Authentication records stop this.
Look-alike spoofing. The attacker registers a near copy, such as a domain with one swapped character. Your records cannot stop this, because it is not your domain. Filtering, labeling and staff habits do.

A complete plan covers both.

Layer one: authenticate your domain with SPF, DKIM and DMARC

These three DNS-based standards let receiving servers check whether a message really came from you.

SPF lists the servers and services allowed to send mail for your domain.
DKIM adds a cryptographic signature to outgoing messages, so the receiver can confirm the message was authorized and not altered in transit.
DMARC tells receivers what to do when a message fails, and requires that the authenticated domain line up with the From address people actually see.

That last point matters. Microsoft's documentation states that SPF and DKIM do not by themselves ensure alignment with the visible From address. DMARC is the check that does. If you want a deeper comparison of the first two, we wrote SPF vs DKIM: what each does and why you need both.

Roll out DMARC in stages

The most common failure we see is a DMARC record that exists but does nothing. MITRE ATT&CK notes that spoofing can succeed when SPF, DKIM or DMARC is absent or weak, and that a policy of p=none does not tell receivers to filter failing messages. A p=none record is a monitoring mode, not protection.

A safe path looks like this:

Inventory every sender. Your mail platform, the invoicing system, the CRM, the marketing tool, the website contact form, the copier that scans to email, the phone system's voicemail-to-email. Each one sends mail using your domain.
Publish SPF and enable DKIM for each of those senders, so legitimate mail passes.
Publish DMARC at p=none with reporting turned on. Read the reports for a few weeks and fix every legitimate sender that fails.
Move to quarantine, ideally applied to a small share of mail first, then to all of it.
Move to reject once the reports are clean. Now forged mail using your exact domain is refused by receivers that honor DMARC.
Repeat for parked and unused domains. Attackers love domains you never send from. Publish a reject policy and an empty SPF record on them.

Why legitimate mail fails, and how to avoid it

Microsoft identifies forwarding, third-party senders and message modification as practical reasons real mail can fail SPF, DKIM or DMARC. That is exactly why step one is an inventory. Enforcing reject before you know every authorized sender can send your own invoices into the void. Do the inventory, then tighten.

You can see where a domain stands today with our Email Trust Checker. We explain what the results mean in why email trust metrics matter.

Layer two: filter and label inbound mail

Authentication protects recipients of your mail. It does little for your own staff reading mail from someone else's forged or look-alike domain. This is where inbound controls earn their keep.

Block outside mail that claims to be inside

One of the simplest, highest-value rules is rejecting messages that arrive from outside your organization but carry your own domain in the From field. Your staff never need to receive that, and it shuts down the "email from the boss" trick that uses your exact name. Most business mail platforms support this rule or a built-in equivalent.

Label external senders

The U.S. Secret Service recommends external-email labeling, employee education, multifactor authentication, network monitoring and registering similar domains as defenses against business email compromise. A visible "External" banner takes seconds to set up. It gives a recipient an instant cue when a message claiming to be from a coworker came from somewhere else.

Register the look-alikes

If your domain is acme-mfg.com, consider registering the obvious variants: a hyphen removed, a common misspelling, a different top-level domain. It costs little and removes the easiest ammunition from an attacker. Also set alerts for newly registered domains that resemble yours.

Add advanced filtering where it fits

Modern filtering services score sender reputation, scan links and attachments, and flag impersonation of named executives. For a business that handles wire transfers, payroll changes or regulated client data, this layer is worth having. It is part of how we approach security as one managed stack. See our cybersecurity solutions for business.

Real senders can still be dangerous

A message that passes every authentication check can still be malicious, for example when an attacker uses a compromised real account or a free mailbox that authenticates perfectly. We cover that in real emails can still be phishing. Authentication tells you who sent a message. It does not tell you whether the sender is honest.

Layer three: train people and verify money requests

The attacks that cost small businesses the most rarely involve malware. They involve a believable message asking someone to change a bank account number.

Build habits around verification

The FBI advises not clicking unsolicited links or attachments, looking up a company's phone number independently, inspecting addresses and URLs carefully, and using multifactor authentication. Turn that into house rules:

Never act on a payment instruction or bank-detail change from email alone.
Call a known contact on a number already on file, not one printed in the message.
Require two approvers above a set dollar amount.
Treat urgency, secrecy and "I'm in a meeting, can't talk" as red flags in themselves.

Nacha's 2024 action plan on business email compromise recommends exactly this combination: confirm payment-instruction changes through a different channel, use dual controls for higher-value transactions, enforce multifactor authentication, and train employees with a written response procedure.

If you want a broader view of the payment-fraud side, our business email compromise prevention guide goes step by step. Our Collett Verify service supports mutual call verification for situations where someone must prove they are who they say.

Teach the header check

Your office manager does not need to read raw headers daily, but one or two people should know how. The NJCCIC's guidance says to check the complete sender address, the spelling of the display name, the Reply-To and the Return-Path. It also warns about look-alike characters, such as a lowercase l swapped for an uppercase I.

To see full headers, use Show original in Gmail, or File, then Properties, then Internet headers in desktop Outlook. Look at the Authentication-Results line for SPF, DKIM or DMARC failures. A mismatch between Return-Path and the visible From can be legitimate for some mailing services, so treat it as a signal and not as proof.

Turn on multifactor authentication everywhere

Spoofing often leads to credential theft. A stolen password plus no second factor means an attacker is in the mailbox, setting forwarding rules and watching invoices. MFA on email, VPN and financial portals breaks that chain. If you want a broader checklist of verification habits and domain monitoring, this covers several of the same ideas.

Quick comparison: what each control stops

Control	Stops exact-domain spoofing	Stops look-alike domains	Helps if a real account is hijacked
SPF, DKIM, DMARC at reject	Yes	No	No
Block outside mail using your domain	Yes	No	No
External sender labels	Partly	Yes, as a visual cue	Partly
Inbound impersonation filtering	Yes	Often	Sometimes
Multifactor authentication	No	No	Yes
Call-back verification for payments	Yes	Yes	Yes

No single row covers the whole table, which is the point. The last row is the only one that works against every case, and it costs nothing but discipline.

If a spoofed email gets through

Speed decides the outcome. Follow this order.

If money was sent, call your bank immediately. Nacha's plan says to ask your financial institution to contact the receiving institution, reverse the transfer and freeze the fraudulent account.
Contact law enforcement through a channel the attacker does not control. The Secret Service guidance also covers notifying your bank, changing passwords and engaging IT response teams. The FBI advises reporting spoofing and phishing to IC3.
Preserve evidence. Keep the original emails with full headers. Do not delete anything.
Change passwords and review the mailbox. Check for malicious forwarding rules, which attackers use to keep reading mail after the first incident. For help with containment steps like these, see this overview of containing an email compromise.
Bring in IT. Find out whether the spoof was only a forged address or whether an account was actually accessed. Those are different incidents with different cleanup.

Our article on catching BEC attacks in progress covers the early warning signs, and our ransomware response plan is a good template for writing your own incident procedure.

Is email spoofing illegal?

Not automatically, but it often is. Under 18 U.S.C. § 1037, it is a federal crime to knowingly and materially falsify header information in multiple commercial email messages and intentionally send them in or affecting interstate or foreign commerce. Penalties include a fine or up to one year in prison in the base case, and up to five years if the offense furthers a felony or the defendant has a qualifying prior conviction.

Spoofing used for fraud or identity theft can bring other charges. The practical takeaway for a business owner: do not count on prosecution to recover funds. Attackers are frequently overseas, and the faster path is bank recall plus prevention.

Our perspective

Most small businesses we meet treat spoofing as an email problem. We treat it as an infrastructure problem. The domain, the mail platform, the filtering, the logins and the payment process all have to agree with each other, and when one is run by a different vendor with a different checklist, the gaps sit between them.

That is why we run email security as part of one standardized, fully loaded stack at a fixed cost per user. Authentication records are published and monitored, not set once and forgotten. Inbound filtering, MFA and 24/7 monitoring sit in the same service as the help desk, so when a user forwards a suspicious message, the person who answers can see the whole picture.

The other half is people. We would rather a staff member call to confirm an invoice change ten times than pay one forged one. Documented procedures, defined response times and real local support are what turn good settings into a habit. Business owners tell us that predictability is what they want from IT, and we agree: no surprises in pricing, and no surprises in your inbox.

Dustin Collett

How Collett Systems helps

If your domain records are a mystery, or you suspect a vendor or two is sending mail on your behalf without being authorized, start with an assessment. Our IT & Security Assessment reviews email authentication, access controls and your payment-verification process, and gives you a documented list of what to fix first. For a quick read on where you stand, try the Free IT Risk Score.

For ongoing coverage, our Managed IT Services include 24/7 monitoring, security management, backup and disaster recovery, and an unlimited help desk, delivered by a local team that serves manufacturers, law offices, dental practices and financial firms across Wisconsin. If you already have in-house IT staff, Co-Managed IT Services can add security depth and monitoring alongside them. Book the IT & Security Assessment and we will show you exactly how your domain looks to the outside world.

FAQ

How do I protect my business from email spoofing?

Publish SPF, DKIM and DMARC for every domain you own, and move DMARC to quarantine and then reject once all legitimate senders pass. Add inbound filtering, external-sender labels and multifactor authentication. Finally, require a phone call to a known number before changing payment details.

Is a DMARC record at p=none enough?

No. A p=none policy only asks receivers to report, not to filter failing mail. MITRE notes that this weak configuration can leave spoofed messages deliverable even when records exist. Treat it as the first step, then enforce.

Can I block spoofed or phishing emails completely?

You can block most exact-domain forgeries with a reject policy and an inbound rule against outside mail using your domain. Look-alike domains and compromised real accounts need filtering, labels and staff verification habits. Layered controls reduce the risk sharply, though no single tool removes it.

How can I tell if an email was spoofed?

Open the full headers and read the Authentication-Results line for SPF, DKIM or DMARC failures. Compare the Return-Path and Reply-To with the visible From address, and look for look-alike characters in the domain. A mismatch is a signal, not proof, since some legitimate mailing services produce one.

What should I do if an employee paid a spoofed invoice?

Call your bank immediately and ask it to contact the receiving institution to recall the transfer. Then report to law enforcement, preserve the original emails, change passwords and check for forwarding rules. Call your IT provider the same day so the mailbox can be reviewed.

Email Spoofing Protection: A Practical Guide for Businesses