Can Criminals Send Email as Your Business? SPF, DKIM and DMARC Explained

Here is an uncomfortable test you can fail without ever knowing. Can a stranger send an email that appears — to your customers, your suppliers, your own staff — to come from your exact business address? For a large share of small and medium businesses, the answer is yes, and nothing warns them.

The reason is baked into how email works. The original internet email standards place, in the words of RFC 7208, "no restriction on what a sending host can use as the 'MAIL FROM' of a message." The "from" address is a claim, not a proof. Three standards exist to turn that claim into something a receiving server can verify — and if you have not configured them, criminals can impersonate your domain with ease.

The three standards, in plain English

SPF (Sender Policy Framework) — you publish, in your DNS, a list of the mail servers allowed to send email for your domain. A receiving server can then check whether a message actually came from one of them. Defined in RFC 7208.

DKIM (DomainKeys Identified Mail) — your outgoing mail is stamped with a cryptographic signature that a receiver verifies against a public key in your DNS. It proves the message really came from your domain and was not altered in transit. Defined in RFC 6376.

DMARC (Domain-based Message Authentication, Reporting and Conformance) — the policy layer that ties the first two together. It lets you "express domain-level policies and preferences for message validation, disposition, and reporting," per RFC 7489. In plain terms: it tells receiving servers what to do with mail that fails your SPF and DKIM checks, and it sends you reports on who is sending mail as you.

The NCSC's own email security and anti-spoofing guidance sums it up: SPF publishes your trusted senders, DKIM signs your mail, and DMARC "allows you to set a policy for how receiving email servers should handle email which doesn't pass either SPF or DKIM checks."

The DMARC policy is the part that actually protects you

A DMARC record carries a policy, and there are three settings, defined in RFC 7489 §6.3:

• p=none — take no action; just send me reports. This monitors but blocks nothing.
• p=quarantine — treat failing mail as suspicious (typically, put it in spam).
• p=reject — reject failing mail outright, during the SMTP transaction.

Many businesses that "have DMARC" are on p=none. That means they get reports but a spoofed email of theirs is still delivered to the inbox. The protection comes from moving — carefully — to quarantine and then reject. The NCSC deliberately recommends starting at p=none to gather reports first, because enforcing too early can send your own legitimate mail to spam. Getting from monitoring to enforcement safely is exactly where most businesses stall.

This is no longer optional for deliverability either

Since 1 February 2024, Google requires that senders of more than 5,000 messages a day to Gmail accounts set up SPF, DKIM and a DMARC record, per its Email Sender Guidelines. Yahoo introduced matching requirements. Authentication is now the difference between reaching the inbox and reaching the spam folder — so the same records that stop impersonation also protect your marketing and invoices from being filtered out.

The scale of the problem it prevents

Email impersonation underpins Business Email Compromise (BEC) — the fake-invoice, fake-CEO, change-of-bank-details fraud. The FBI's 2024 Internet Crime Report recorded $2.77 billion in BEC losses across 21,442 complaints in a single year, and a September 2024 FBI advisory put cumulative global BEC exposure at over $55 billion. The UK Government's Breaches Survey separately found people impersonating an organisation in email is the second most common attack type businesses report.

The good news is that the UK public sector has shown it is fixable at scale: the NCSC Annual Review 2024 reported over 34,600 domains using its Mail Check service, 60% of them protected by DMARC.

Where to start

Checking your domain's SPF, DKIM and DMARC — and, crucially, reading the DMARC reports to move safely from monitoring to enforcement without losing legitimate mail — is one of the highest-value, lowest-cost things a business can do for its security. It is a standard part of our Security Posture Review, alongside your website, network and cloud (see the gaps an attacker looks for first).

If you would like to know whether someone can currently send email as your business, book a free scoping call.

This article is general information, not security advice specific to your systems. All testing we carry out is done only with your signed authorisation.