What does email spoofing mean?

Email spoofing happens when a message is made to appear as though it came from an address or domain the sender does not control. The visible “From” address alone is not proof that a message is authentic.

The three records to check

SPF: Who is allowed to send?

SPF lists the servers and services authorized to send mail for a domain. A missing, incorrect, or overly broad record can weaken protection or cause legitimate delivery problems.

DKIM: Was the message signed?

DKIM adds a cryptographic signature to outgoing messages. Receiving systems use the public key published in DNS to verify that the signed parts of the message were not altered and that the sending service was authorized to sign for the domain.

DMARC: What should receivers do?

DMARC connects SPF and DKIM to the domain shown in the From address. It can instruct receiving systems to monitor, quarantine, or reject messages that fail authentication and alignment checks.

A record existing does not always mean the domain is protected.

A weak DMARC policy such as monitoring-only may collect useful reports without blocking impersonation. Configuration quality matters as much as record presence.

How to perform a basic check

  1. Enter your company’s domain—not an email address—into a reputable domain-security scanner.
  2. Review SPF, DKIM, and DMARC separately.
  3. Confirm that every legitimate sending service is accounted for before enforcing a stricter policy.
  4. Correct syntax, alignment, or policy problems.
  5. Retest after DNS changes have propagated and document the result.

Warning signs that need attention

  • No DMARC record is published.
  • DMARC remains at p=none without a plan to move toward enforcement.
  • SPF contains unknown services, excessive lookups, or more than one SPF record.
  • DKIM is missing for a service that sends business email.
  • Authentication passes, but the domains do not align with the visible From address.

What a public scan cannot prove

A public DNS scan cannot confirm whether every mailbox uses multifactor authentication, whether accounts are compromised, or whether all private administrative settings are secure. Those controls require an authorized review of the email environment.

Start with your own domain

Andida Secure’s free snapshot checks publicly visible email-authentication records and explains which areas need review. The complete report adds technical evidence, business impact, and a prioritized correction plan.

Scan your business domain →