Domain spoofing: How Attackers Send Emails from Your Business Address

How Domain Spoofing Works and Why Most Businesses Have No Idea It Is Happening

You did not send that email.

But it came from your domain.

It had your name on it. It used your business address. It landed in your customer's inbox looking exactly like every other legitimate email you have ever sent them.

Domain spoofing is one of the most straightforward methods attackers use to run scams in a business's name.

And one of the least visible to the business is being impersonated.

And it's working because most businesses either do not have the right records in place or have them set up incompletely.

Why This Matters

Most business owners assume that their email is protected because they have a professional domain and a business email address.

That assumption has a significant gap in it.

Having a domain does not automatically prevent someone else from sending emails that appear to come from it. Without the right authentication records in place, anyone with basic email knowledge can do exactly that.

They do not need access to your systems.

They do not need your password.

They just need to know your domain name.

This is one of the most common and overlooked email security risks facing businesses today, and one of the easiest for attackers to exploit without ever touching your systems.

The Real Problem

Sending an email is not the same as owning a domain.

From your domain name alone, an attacker can send emails to your customers requesting payment to a new account. They can impersonate your leadership in messages to staff. They can target your vendors with fake invoice requests.

Everything looks like it came from you.

And your customers have no obvious reason to question it.

The three records that protect your domain each do a different job:

• SPF tells receiving mail servers which servers are authorized to send email on behalf of your domain. If a message comes from anywhere else, SPF flags it.
  
  
• DKIM adds a hidden cryptographic signature to every outgoing email. Receiving servers use this signature to verify that the message was not tampered with.
  
  
• DMARC is the policy layer. It tells receiving mail servers what to do when an email fails SPF or DKIM checks — monitor it, quarantine it, or reject it outright.

Most businesses either do not have all three in place or have DMARC set to monitor rather than block. That means spoofed emails are still reaching inboxes even when the other records exist.

Cybersecurity Tip: Protect Your Domain From Spoofing

Most of these fixes are straightforward. The important thing is knowing which ones you are missing.

• Check your current SPF, DKIM, and DMARC records
  Aurora InfoTech's free Domain Scanner checks all three in seconds and shows you exactly what is configured and what is missing.
  
  See exactly what is missing from your domain protection ➡️
  
  
• Make sure DMARC is set to enforce, not just monitor
  A monitoring-only DMARC policy logs fake emails but still lets them reach inboxes.
  
  
• Include BIMI if your brand visibility matters
  BIMI allows your logo to appear in supported email clients, building recipient trust and confirming your messages are authenticated.
  
  
• Review any third-party tools that send email on your behalf
  Marketing platforms, billing tools, and CRMs all need to be authorized in your SPF record, or they may fail authentication checks.
  
  
• Make domain security part of your regular IT review
  DNS records can drift over time as tools are added and removed.

Your domain is your business identity online.

If it is not protected, someone else can use it without your knowledge.

Knowing what is missing is the first step. Fixing it correctly is the next one.

You may also want to read: 

Business Email Compromise Doesn't Start With a Hacker. It Starts With a Trusted Email. ➡️

Aurora InfoTech Is Here to Support You

At Aurora InfoTech, we are dedicated to helping business owners strengthen their email security and Cybersecurity defenses through proactive IT support and practical security solutions.

With our team of experts and comprehensive Managed IT Services, we help ensure your systems and data are protected against evolving cyber threats.