Answers › Technical support and security

What is email spoofing, and how do you stop someone sending email as your business?

Ascent Vision · Published October 31, 2026

Email spoofing is sending a message with a forged sender, so it appears to come from your business or domain. No setting can stop anyone from trying, but three settings on your domain, called SPF, DKIM and DMARC, can make forged mail easier for receiving services to catch. Ask whoever runs your email to confirm all three are on, tell customers who report fake messages, and check whether any account was actually taken over.

What spoofing is and what customers see

A spoofed email shows your business name or an address at your domain as the sender, though your mailbox never sent it. A customer may see a message that looks like it came from you asking for payment to a new account, or a link to click. If they act on it, they may blame you. Google's sender guidelines tell senders not to "impersonate other domains or senders without permission" and call this practice spoofing.

The related answers on spotting a fake invoice or payment-change email and on spotting a phishing email cover what customers and staff should look for.

The three settings, in plain words

• SPF: a line of text added to your domain that lists the servers allowed to send email for it. Google's help page says receiving servers check it to verify that messages came from authorized servers.
• DKIM: a digital signature added to each outgoing message, which receiving servers check against a public key published on your domain. Google's help page says it helps protect your domain against spoofing.
• DMARC: instructions telling receiving servers what to do with mail from your domain that fails SPF or DKIM: reject it, send it to spam or deliver it. Google's help page says SPF or DKIM must be on first, and recommends starting with the policy that takes no action and tightening it over time.

Who turns them on

Those three Google pages are written for Google Workspace customers, and other email providers have their own equivalents. In each case the settings are added at the domain host, so the business needs a login there; the related answer on using your own domain for business email covers why the business should control it. Google's sender guidelines also recommend DMARC reports, which it says help you identify senders that may be impersonating your domain.

Your own mail landing in spam is a related but different problem; the related answer on why business emails go to spam covers what Gmail and Yahoo ask of senders.

If customers report fake emails from you

• Tell customers through a channel they trust, such as your website or a call: do not click, do not pay, and check any payment change by phone using a number you already have.
• Ask the customer to forward the message with its full details to whoever runs your email, and report it to your email provider.
• Check whether an account was actually taken over. A spoofed message often never passed through your mailbox, so your sent folder may show nothing, while a hacked account usually leaves signs such as messages you did not send or forwarding rules you did not set up.
• If an account was taken over, the related answer on what to do if your business email account is hacked covers the steps.

Sources

1. Google, "Email sender guidelines", Gmail Help
2. Google Workspace Admin Help, "Set up SPF"
3. Google Workspace Admin Help, "Set up DKIM"
4. Google Workspace Admin Help, "Set up DMARC"

Related answers

• Why are my business emails going to spam?
• What should you do if your business email account is hacked?
• How do you spot a phishing email or text, and what should staff do with it?
• How do you spot a fake invoice or a payment-change email?
• Should your business email use your own domain instead of a free address?