Email spoofing is when someone sends messages that appear to come from your domain — your brand, your name — without your knowledge. It's one of the most common ways phishing attacks reach people, and it's straightforward for an attacker to do if you haven't set up the right DNS records.
Why it's possible
Email's original design has no built-in authentication. The "From" field is just text — there's no automatic check that the sender actually controls the domain shown. Three DNS standards — SPF, DKIM, and DMARC — exist specifically to fix this.
Step 1: Add an SPF record
SPF lists the mail servers legitimately allowed to send on your behalf. Add a TXT record to your DNS that names those servers.
If you send through Google Workspace:
v=spf1 include:_spf.google.com ~all
If you use multiple services (a CRM, a transactional email tool), each needs to be included. Ask each provider for their SPF include value.
Step 2: Enable DKIM signing
DKIM lets your mail server sign outgoing emails with a private key. Recipients verify the signature against a public key in your DNS. Most email providers generate a DKIM key pair for you — you publish the public key as a DNS TXT record.
Step 3: Add a DMARC policy
DMARC tells receiving servers what to do when an email fails SPF or DKIM. Start with monitoring:
v=DMARC1; p=none; rua=mailto:[email protected]
Once you're confident only legitimate mail is passing, move to p=quarantine then p=reject.
Step 4: Cover your subdomains
Attackers spoof subdomains when the main domain is protected but subdomains aren't. Your DMARC record covers subdomains with the sp= tag.
threatprobe.app checks all three records and flags missing or misconfigured entries in plain language.