How to Protect Your Business Email from Spoofing
Configuring SPF, DKIM and DMARC to stop attackers impersonating your domain.
// Contents+
Email spoofing is one of the most common ways attackers target UAE businesses. Someone sends an email that appears to come from your domain — your CEO, your finance manager, your company address — and tricks a supplier or employee into transferring money or sharing sensitive information. The fix is technical, and most businesses have not done it properly.
- 01Three DNS records — SPF, DKIM and DMARC — work together; none of them alone stops spoofing.
- 02Use -all (hard fail) in your SPF record, not ~all, once every legitimate sender is confirmed.
- 03Roll DMARC out gradually: p=none (monitor) → quarantine → reject, over about 4 weeks.
- 04The whole setup takes roughly 2–3 hours of IT work plus 4 weeks of monitoring — one of the highest-impact, lowest-cost fixes available.
What Is Email Spoofing?
Spoofing means sending an email with a forged "From" address. The attacker does not need to hack your email system. They simply send an email claiming to be from [email protected], and if you have not configured your DNS records correctly, many mail servers will accept it and deliver it.
This is why Business Email Compromise (BEC) attacks cost businesses globally billions of dollars every year — and UAE companies are actively targeted.
The Three Records That Stop Spoofing
There are three DNS-based email authentication standards that, when configured correctly, make it extremely difficult to spoof your domain.
SPF — Sender Policy Framework
SPF is a DNS record that lists which mail servers are allowed to send email on behalf of your domain. If an attacker tries to send email from an unlisted server, receiving mail systems can reject or flag it.
A basic SPF record for a Microsoft 365 tenant looks like:
v=spf1 include:spf.protection.outlook.com -allThe -all at the end means: reject everything that does not match. Many businesses use ~all (soft fail) which only marks suspicious mail — less protection.
DKIM — DomainKeys Identified Mail
DKIM adds a cryptographic signature to every outgoing email. The receiving server checks the signature against a public key published in your DNS. If the email was tampered with or sent from an unauthorised server, the signature fails.
In Microsoft 365, DKIM must be explicitly enabled for each domain in the Defender portal. It is not on by default for custom domains.
DMARC — Domain-based Message Authentication, Reporting and Conformance
DMARC builds on SPF and DKIM. It tells receiving mail servers what to do when an email fails authentication: nothing (none), send it to junk (quarantine), or reject it entirely (reject).
It also sends you reports — XML files that show you who is sending email claiming to be from your domain. These reports are invaluable for spotting attackers and misconfigured systems.
A starting DMARC record:
v=DMARC1; p=none; rua=mailto:[email protected]Start with p=none to collect reports without blocking anything. Once you confirm all legitimate senders are passing, move to p=quarantine then p=reject.
What Happens Without These Records?
Without SPF, DKIM, and DMARC:
- Anyone can send email claiming to be from your domain
- Your own outbound emails may land in spam at recipient companies
- You have no visibility into who is impersonating you
- You fail basic cybersecurity audits and some client security assessments
Step-by-Step: What to Ask Your IT Provider to Do
This entire process typically takes 2 to 3 hours of IT work and 4 weeks of monitoring. It is one of the highest-impact, lowest-cost security improvements any business can make.
- Check your current SPF record — does it exist? Is it set to -all?
- Enable DKIM signing in Microsoft 365 Defender for your domain
- Publish the DKIM CNAME records in your DNS
- Add a DMARC record starting with p=none and a reporting address
- Wait 2 to 4 weeks and review the DMARC reports
- Move DMARC policy to p=quarantine, then p=reject once clean
Frequently asked questions
Will enabling DMARC break my email?+
Not if done correctly. Starting with p=none means no email is blocked — you only receive reports. The risk comes if you jump straight to p=reject before verifying all your legitimate sending sources (like marketing tools, accounting software, or third-party systems that send on your behalf).
Does SPF alone protect me from spoofing?+
No. SPF alone has significant gaps — it does not protect against header-from spoofing, which is what most BEC attacks use. You need all three: SPF, DKIM, and DMARC together.
How do I read DMARC reports?+
DMARC reports are sent as XML files which are difficult to read manually. Tools like MXToolbox, Dmarcian, or Postmark's DMARC Digests parse these reports into readable dashboards — most have a free tier.
What if I use third-party tools like Mailchimp or an accounting system that sends email from my domain?+
These need to be added to your SPF record and may need their own DKIM keys. Your DMARC reports will show you exactly which systems are sending from your domain, making it easy to identify what needs to be configured.
More from our knowledge base
Need help applying this to your business?
Our Dubai-based engineers can audit your setup and recommend the right next steps.