How to Stop Email Spoofing: A Small Business Guide

By /

Last updated: October 2026

Disclosure: This guide contains no paid placements or affiliate links. It is based on email security work with small businesses and on Microsoft and Google documentation. See our Editorial Policy.

A supplier receives an email from your finance manager asking them to update your bank details. It has your name, your logo and your email address. Except it was never sent by you. That is email spoofing, and it is one of the most common ways small businesses lose money through invoice fraud and business email compromise.

This guide explains the three types of email spoofing, how to stop criminals sending email as your domain, how to protect your staff from spoofed emails coming in, and what to do if it is already happening.

What is email spoofing?

Email spoofing is when someone sends an email that pretends to come from a person or organisation it did not come from. Email was designed decades ago without built-in sender checks, so the “From” name and address can be faked unless the receiving mail system checks them properly.

Spoofed emails are usually used to:

  • Trick customers or suppliers into paying fake invoices
  • Get staff to share passwords or approve payments
  • Spread malware through “trusted” attachments
  • Damage your reputation, because the email appears to come from you

The 3 types of email spoofing

Knowing which type you are dealing with tells you which fix you need.

Type What the attacker does Example Main fix
Exact-domain spoofing Uses your real domain in the From address ahmed@yourcompany.com, but sent from the attacker’s server SPF, DKIM and DMARC at p=reject
Display-name spoofing Uses your name with a different address “Ahmed (CEO)” <ceo.urgent@gmail.com> External-sender tags, impersonation protection, staff training
Look-alike domains Registers a domain that looks like yours yourcompany-invoices.com or yourcompanny.com Domain monitoring, impersonation protection, payment checks

Most businesses only think about the first type. Criminals know this, which is why display-name and look-alike attacks are so common.

Part 1: Stop criminals sending email as your domain

This protects your customers, suppliers and reputation from exact-domain spoofing.

Step 1: Set up SPF, DKIM and DMARC

These three DNS records let receiving mail servers check whether an email really came from you:

  • SPF lists the servers allowed to send email for your domain.
  • DKIM signs your emails so receivers can verify them.
  • DMARC tells receivers to reject email that fails those checks, and sends you reports.

Our step-by-step DMARC setup guide covers all three, including the exact settings for Microsoft 365 and Google Workspace.

Step 2: Move DMARC to enforcement

A DMARC record set to p=none only monitors; it does not stop spoofing. Once your reports show that your real email passes, move to p=quarantine and then p=reject. Only then will Gmail, Outlook and other providers refuse email that fakes your exact domain.

Step 3: Protect domains you don’t send email from

Criminals also spoof domains you own but don’t use for email, such as old brand names or parked domains. Add these two records to each one:

v=spf1 -all
v=DMARC1; p=reject;

The first says “no server sends email for this domain”; the second tells receivers to reject anything that claims to.

Part 2: Protect your staff from spoofed emails coming in

DMARC protects your domain. It does nothing about criminals impersonating your CEO from a Gmail address, or spoofing your suppliers. For that you need inbound protection.

In Microsoft 365

  1. Tag external emails. Turn on the “External” tag in Outlook so staff can see when an email comes from outside the company, even if it uses a colleague’s name. An admin can enable it with the Exchange Online PowerShell command:

    Set-ExternalInOutlook -Enabled $true

  2. Check the anti-phishing policy. In the Microsoft Defender portal, go to Email & collaboration → Policies & rules → Threat policies → Anti-phishing. Make sure spoof intelligence is on, and that messages failing DMARC are quarantined or moved to Junk.

  3. Turn on impersonation protection if you have it. Plans that include Microsoft Defender for Office 365 (for example Microsoft 365 Business Premium) let you protect specific people, such as your CEO and finance team, and your own domains against impersonation.

  4. Show first-contact safety tips, which warn staff when they receive email from someone they have never emailed before.

In Google Workspace

  1. Open the Google Admin console and go to Apps → Google Workspace → Gmail → Safety.
  2. Under Spoofing and authentication, turn on protection against:
    • Domains similar to your domain name
    • Spoofing of employee names
    • Inbound emails spoofing your own domain
    • Unauthenticated emails
  3. Choose to show a warning or move suspicious messages to spam.
  4. Make sure external recipient warnings are on in Gmail settings.

For any email system

  • Use a business email security service if your platform’s built-in protection is not enough; many small businesses add one on top of Microsoft 365 or Google Workspace.
  • Block auto-forwarding to external addresses, which attackers use after taking over a mailbox.
  • Turn on multi-factor authentication for every mailbox. A real account taken over by criminals is even more convincing than a spoofed one.

Part 3: Train your team and fix your payment process

Technology catches most spoofing, but not all of it. The final layer is people and process:

  • Verify every payment or bank-detail change by phone, using a number you already have, not the one in the email.
  • Slow down on urgent requests. “Urgent”, “confidential” and “the CEO needs this today” are classic pressure tactics.
  • Check the real address, not just the name. On mobile, tap the sender name to see the full email address.
  • Make reporting easy. Give staff a simple “Report phishing” button or a shared address, and thank them for reporting, even false alarms.
  • Run short training sessions a few times a year with real examples.

Is your domain being spoofed right now? What to do

Signs include customers asking about emails you never sent, bounce-back messages for emails you did not send, or DMARC reports showing unknown servers sending as your domain.

  1. Check your DMARC record. If you don’t have one, set it up today. If it is at p=none, plan your move to p=reject.
  2. Read your DMARC reports to see which servers are sending as you.
  3. Warn customers and suppliers that fake emails are circulating, and remind them you will never change bank details by email.
  4. Check your own mailboxes for unknown forwarding rules and unusual sign-ins, in case an account was actually compromised rather than spoofed.
  5. Report serious fraud to your bank immediately and to your national cybercrime reporting service.

Email spoofing protection checklist

  • SPF record published, with one record only
  • DKIM turned on for every service that sends your email
  • DMARC published and moved to p=quarantine or p=reject
  • Unused domains locked with v=spf1 -all and p=reject
  • External-sender tags turned on
  • Anti-phishing and impersonation protection reviewed
  • Multi-factor authentication on every mailbox
  • Auto-forwarding to external addresses blocked
  • Phone verification for every payment or bank-detail change
  • Staff trained to check the real sender address

Frequently asked questions

Can email spoofing be completely stopped? Exact-domain spoofing can be stopped almost entirely with DMARC at p=reject. Display-name and look-alike spoofing cannot be fully blocked by DNS records, which is why inbound protection and staff training matter.

Is email spoofing the same as a hacked email account? No. Spoofing fakes the sender without accessing your account. A hacked account is real access to your mailbox, which is more dangerous. Multi-factor authentication is the best protection against that.

Will DMARC stop someone spoofing my CEO’s name from Gmail? No. DMARC only protects your exact domain. Name impersonation from other domains needs impersonation protection and external-sender warnings.

Does email spoofing affect deliverability? Yes. If criminals send spam using your domain, mail providers may start treating your real emails with suspicion. A strict DMARC policy helps protect your domain’s reputation.

Email security settings and menu locations change over time. This guide reflects Microsoft 365 and Google Workspace as of October 2026.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top