Guide

Email spoofing: how criminals send email as your firm, and what stops them

By Adam Sierant, Director of Northstar Infinity Works Ltd · Updated 10 September 2026 · 5 min read

How spoofing works

An email has an envelope, which mail servers use to deliver it, and a header, which holds the From address the reader sees. Standard email makes no effort to check that the sender is who they claim to be, and the envelope and From addresses do not have to match.^[1] A criminal can therefore send a message from their own server, using their own envelope domain, and write your firm’s address in the From line.

Microsoft’s documentation gives the textbook case: a message whose envelope uses one domain while its From line shows a bank’s address. It is perfectly valid as far as the delivery protocol is concerned, and it is a classic spoof.^[1]

A cruder trick changes only the display name, so that “Samplefirm Accounts” appears above an address at a free webmail provider. DMARC is concerned with the domain in the From address, not the name shown beside it, which is why staff who handle payments should read the address itself.^[2]

Three ways criminals impersonate a firm

Take Five describes both of the harder routes in property fraud: criminals usually gain access to genuine legal email accounts, and also use addresses that closely mimic a real firm’s.^[3] DMARC deals only with the first row. But the first row is also the cheapest for a criminal, needs no hacking and no registration, and is the one a firm can close completely with its own DNS settings.

Why SPF and DKIM alone do not stop it

Many firms already publish SPF and assume they are protected. SPF checks the envelope domain, not the From address, so a spoofer using their own envelope domain can pass SPF for that domain.^[1] DKIM proves that a message was signed by some domain, not that the signing domain is the one in the From line.^[1]

DMARC adds the missing check: the domain that passed has to align with the From domain.^[2] The policy then decides what receivers are asked to do. At none, they are asked to do nothing with spoofed mail; at quarantine or reject, they are asked to junk it or refuse it.^[4]

Signs that your domain is being spoofed

• Bounce messages for email nobody at the firm sent. They appear when a spoofer also puts your domain in the envelope address, which is where bounces are returned.^[1]
• Clients or other firms asking about messages that did not come from you.
• Sources in your DMARC aggregate reports that no service at the firm accounts for, often failing both SPF and DKIM.^[4]

Without a DMARC record that names a reporting address, the third sign is invisible, which on its own is a good reason to publish one.

Can someone send email from my domain without my password?

Yes, in the sense that they can put your address in the From line, and a receiver with no other signals may accept the message. Whether it reaches anyone depends on your DMARC policy and on the receiver’s own filtering. Microsoft 365, for instance, combines authentication results with signals such as sender reputation and history, so a failed check does not automatically mean a blocked message.^[1] Your policy is the one part of that decision you control.

If mail is going out from a real mailbox at the firm, that is not spoofing, and DMARC will not stop it. The account needs its password changed, its sign-ins and forwarding rules reviewed, and its multi-factor authentication checked.

What to put in place

1. Publish SPF and DKIM for every service that sends as the firm, including DKIM signing with your own domain in Microsoft 365.^[5]
2. Publish DMARC with a reporting address, and read the reports.
3. Move to quarantine and then to reject once legitimate mail passes. The NCSC calls reject on all of your domains the best way to prevent spoofing of your email.^[6]
4. Give domains the firm owns but does not use for email a reject record of their own.^[4]
5. Tell clients how you will and will not send bank details. The SRA suggests telling clients that you would never change your bank details by email.^[7]

The first four are settings. The fifth is a habit, and it is the one that still works when a criminal uses a lookalike domain or a stolen password.

What to tell staff

• Read the address, not just the display name, before acting on any request that involves money, bank details or passwords.
• Treat urgency, secrecy and changed bank details as reasons to stop and check, never as reasons to hurry.
• Report a suspicious message to whoever looks after IT even if nothing was clicked, because the same message has usually reached other people too.
• Forward a suspicious message as an attachment where you can, so that the headers the IT provider needs travel with it.

None of this replaces the settings above, and the settings do not replace it: a policy of reject does nothing about a lookalike domain, and even careful staff cannot inspect every message.

See where your domain stands

The free domain check shows whether your domain publishes SPF and DMARC, and which policy it asks receivers to apply. For how the records fit together, read SPF, DKIM and DMARC explained, or arrange a scope call to go through your firm’s set-up with your IT provider.