How to Protect Your Business Email from Spoofing

What Is Email Spoofing?

Spoofing means sending an email with a forged "From" address. The attacker does not need to hack your email system. They simply send an email claiming to be from [email protected], and if you have not configured your DNS records correctly, many mail servers will accept it and deliver it.

This is why Business Email Compromise (BEC) attacks cost businesses globally billions of dollars every year — and UAE companies are actively targeted.

The Three Records That Stop Spoofing

There are three DNS-based email authentication standards that, when configured correctly, make it extremely difficult to spoof your domain.

SPF — Sender Policy Framework

SPF is a DNS record that lists which mail servers are allowed to send email on behalf of your domain. If an attacker tries to send email from an unlisted server, receiving mail systems can reject or flag it.

A basic SPF record for a Microsoft 365 tenant looks like:

v=spf1 include:spf.protection.outlook.com -all

The -all at the end means: reject everything that does not match. Many businesses use ~all (soft fail) which only marks suspicious mail — less protection.

DKIM — DomainKeys Identified Mail

DKIM adds a cryptographic signature to every outgoing email. The receiving server checks the signature against a public key published in your DNS. If the email was tampered with or sent from an unauthorised server, the signature fails.

In Microsoft 365, DKIM must be explicitly enabled for each domain in the Defender portal. It is not on by default for custom domains.

DMARC — Domain-based Message Authentication, Reporting and Conformance

DMARC builds on SPF and DKIM. It tells receiving mail servers what to do when an email fails authentication: nothing (none), send it to junk (quarantine), or reject it entirely (reject).

It also sends you reports — XML files that show you who is sending email claiming to be from your domain. These reports are invaluable for spotting attackers and misconfigured systems.

A starting DMARC record:

v=DMARC1; p=none; rua=mailto:[email protected]

Start with p=none to collect reports without blocking anything. Once you confirm all legitimate senders are passing, move to p=quarantine then p=reject.

What Happens Without These Records?

Without SPF, DKIM, and DMARC:

• Anyone can send email claiming to be from your domain
• Your own outbound emails may land in spam at recipient companies
• You have no visibility into who is impersonating you
• You fail basic cybersecurity audits and some client security assessments

Step-by-Step: What to Ask Your IT Provider to Do

This entire process typically takes 2 to 3 hours of IT work and 4 weeks of monitoring. It is one of the highest-impact, lowest-cost security improvements any business can make.

• Check your current SPF record — does it exist? Is it set to -all?
• Enable DKIM signing in Microsoft 365 Defender for your domain
• Publish the DKIM CNAME records in your DNS
• Add a DMARC record starting with p=none and a reporting address
• Wait 2 to 4 weeks and review the DMARC reports
• Move DMARC policy to p=quarantine, then p=reject once clean