How do I stop someone from spoofing my email domain?
Short answer
Publish SPF and DKIM for every service that sends your email, then publish a DMARC record and move it in stages to p=reject once reports show legitimate mail passes. Domains that never send email should publish a strict SPF and DMARC reject policy too.
The details
DMARC stops exact-domain spoofing. It does not stop look-alike domains, so staff still need to check sender addresses carefully.
What to do
- List every service that sends mail as your domain.
- Set up SPF and DKIM for each.
- Publish DMARC at p=none with a reporting address.
- Review reports, fix failures, then move to quarantine and reject.
Terms explained
- DMARC
- DMARC is a DNS policy that tells receiving mail servers what to do with email that fails SPF and DKIM alignment for your domain, and where to send reports about it.
- DKIM
- DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email so receivers can verify it came from an authorized sender for the domain and was not altered in transit.
- SPF
- SPF (Sender Policy Framework) is a DNS record listing the servers allowed to send email for a domain.
Sources
Related questions
Related Guides
GuideWeb Security
How to Prevent a DDoS Attack (Step-by-Step Guide for 2026)
Protect your website infrastructure from crashing. Learn the 6 best defensive measures to block malicious traffic, implement rate limiting, and stop DDoS attacks before they cost you revenue.
Read more GuideWeb Security
How to Protect Your Projects From Malicious npm Packages (and What GitHub's New Package Firewall Does)
GitHub launched a package firewall that blocks risky npm packages before they install. Learn how it works, who can use it and 10 steps any team can take today.
Read more GuideWeb Security
How to Check Security Headers of a Website
Learn how to check security headers of a website using browser developer tools and terminal commands to defend against clickjacking, XSS, and MIME sniffing.
Read more GuideWeb Security
PHP2Shell (CVE-2026-109618 and CVE-2026-109619): How to Patch, Mitigate and Detect Attacks
Two critical PHP flaws allow unauthenticated remote code execution. See who is affected, the fixed versions, temporary mitigations and what to watch for in your logs.
Read more