How to detect if someone is spoofing your domain and stop it

This landed in my inbox three weeks ago.

Subject: "MetaMask: Action Required" Sender: upzizaan@ehz.io via infraova.com

It looked completely legitimate.

Someone was using my own domain infraova.com to send phishing emails. Gmail caught it and dropped it in spam. But here's what scared me: I had no idea it was happening until it landed in my own inbox by accident.

If it had gone to my users instead, I would have found out from them.

That's the problem with domain spoofing. It happens silently. No alert fires. No dashboard turns red. You find out when someone forwards you the phishing email your "company" just sent them.

What domain spoofing actually is

Domain spoofing is when someone sends email that appears to come from your domain without your authorization. They don't need access to your servers, your DNS, or your email provider. They just need your domain name which is public and a mail server willing to send on their behalf.

The result: recipients see your domain in the From field. Your brand. Your reputation. Their trust exploited.

It's used for phishing, business email compromise, and credential theft. And it's more common than most agencies realize, because most domains are wide open to it.

Why most domains are vulnerable

The protection against spoofing is DMARC. Specifically, your DMARC policy tag.

There are three settings:

• p=none monitor only. Unauthorized senders can use your domain and Gmail will deliver it anyway. This is where most domains sit.
• p=quarantine suspicious email goes to spam. Better, but not blocked.
• p=reject unauthorized senders are blocked outright. Nothing gets through.

If your DMARC record says p=none, anyone can spoof your domain right now. Gmail, Yahoo, and Microsoft will accept and deliver it.

Check yours by running:

nslookup -type=TXT _dmarc.yourdomain.com

If you see p=none or no DMARC record at all you're exposed.

How spoofing shows up in DMARC reports

Every major mail provider Google, Yahoo, Microsoft, Apple sends daily aggregate reports to the address in your DMARC rua= tag. These reports contain every email sent from your domain in the past 24 hours, including unauthorized ones.

Here's what a spoofing attempt looks like in a DMARC report:

<record>
  <row>
    <source_ip>185.220.101.45</source_ip>
    <count>47</count>
    <policy_evaluated>
      <disposition>none</disposition>
      <dkim>fail</dkim>
      <spf>fail</spf>
    </policy_evaluated>
  </row>
</record>

An IP address you don't recognize. DKIM fail. SPF fail. 47 emails sent using your domain in one day.

That's a spoofing attempt. And with p=none, every one of those 47 emails landed in someone's inbox.

The problem: DMARC reports are compressed XML files sent as email attachments. Reading them manually requires extracting a zip, parsing XML, and knowing what to look for. Most agencies never look at them at all.

How to detect spoofing in real time

After my own domain got spoofed, I built a feature into Infraova that does this automatically.

Every time a DMARC aggregate report arrives, Infraova parses it and flags any record where:

• The source IP is not an authorized sender
• Both DKIM and SPF fail alignment
• The email count is above zero

When that pattern appears, an alert fires immediately before the next report cycle, before a client forwards you the phishing email, before the damage is done.

The alert tells you which IP is sending, how many emails went out, which mail providers received them, and whether your current policy would have blocked them.

For agencies managing client domains, this matters more than it does for single-domain operators. One spoofed client domain is a client relationship at risk. Ten unmonitored client domains is ten open attack surfaces.

How to stop spoofing entirely

Detection tells you it's happening. Prevention stops it.

The fix is moving your DMARC policy from p=none to p=reject. But you can't do that safely until your legitimate email is fully authenticated otherwise you'll block your own emails along with the spoofed ones.

The safe path:

Step 1 Audit your authorized senders

Every service sending email from your domain needs a valid DKIM signature and SPF record. Check your DMARC reports for authorized IPs that are currently failing authentication. Fix those first.

Step 2 Move to p=quarantine

Once your legitimate senders are all passing, move to quarantine. This sends spoofed emails to spam instead of the inbox. Monitor for 2-4 weeks to confirm nothing legitimate is being caught.

Step 3 Move to p=reject

When you're confident everything legitimate is passing, move to reject. Unauthorized senders are now blocked at the mail server level. Your domain can no longer be spoofed successfully.

The whole process takes 2-6 weeks depending on how many sending services you use. For a single domain with one or two senders, it can be done in days.

What this means for agencies

If you manage email infrastructure for clients, each client domain is its own attack surface.

A client running email campaigns probably has three or four authorized senders their ESP, their CRM, their transactional email provider, maybe a support tool. Each one needs to be in SPF. Each one needs DKIM configured. And the DMARC policy needs to be at quarantine or reject before you can say the domain is protected.

Most agency clients are sitting at p=none. Most have never looked at a DMARC report. And most won't know their domain is being used for phishing until a recipient tells them.

The agency that catches it first keeps the client. The agency that finds out from the client has a harder conversation.

Check your domains now

Run this on any domain you manage:

nslookup -type=TXT _dmarc.clientdomain.com

If you see p=none or nothing at all that domain is spoofable today.

Infraova monitors this automatically across all your client domains, parses every DMARC report as it arrives, and fires an alert the moment a spoofing attempt appears. Start a free trial →

The difference between exact-match spoofing and look-alike domains

DMARC protects against exact-match spoofing someone using yourcompany.com in the From address without authorization. It does not protect against look-alike domains.

Look-alike attacks register domains that visually resemble yours: yourcompany-support.com, yourcompany.co, yourcornpany.com (with an n replacing m). These domains pass DMARC because they have their own DNS records they're just not your domain.

For agencies managing client domains, both threats matter:

• Exact-match spoofing is stopped by moving to p=reject. DMARC handles this.
• Look-alike domains require separate monitoring watching for newly registered domains that closely resemble your clients' domains.

The two attack vectors are often used in sequence. A spoofing attempt on the exact domain gets blocked once DMARC is enforced, so attackers register a look-alike and pivot there instead.

Reading DMARC reports without the XML

Most domain owners set up a DMARC record with an rua= address, receive the reports once, see a wall of XML, and never open them again. That's the gap attackers rely on.

A typical aggregate report looks like this when parsed:

The first row is Google's servers legitimate. The third row is probably a sending service that's authorized in SPF but not signing with DKIM needs fixing. The second row is spoofing: an IP you don't recognize, both SPF and DKIM failing, 47 emails sent.

With p=none, all 47 of those spoofed emails were delivered. That's the report telling you your domain is being actively abused if anyone reads it.

For a deeper look at how the progression from p=none to p=reject works and how to do it without breaking legitimate mail, see DMARC p=none vs p=quarantine vs p=reject explained.

What happens to spoofed emails at each DMARC policy

Understanding the policy impact helps prioritize the rollout for client domains:

At p=none: Spoofed emails are delivered to the inbox. The recipient sees your client's domain in the From field. The DMARC report records the attempt, but no action is taken. The attack works.

At p=quarantine: Spoofed emails are routed to the spam folder. The attack is degraded but not stopped some recipients check spam, and phishing links still work if clicked.

At p=reject: Spoofed emails are refused by the receiving mail server before they reach anyone. The attack fails entirely. The attacker's mail server receives a bounce.

This is why p=reject is the only policy that actually stops spoofing quarantine slows it down but doesn't stop it.

How to prioritize spoofing protection across a client portfolio

If you manage 20 or 50 client domains, you can't move them all to p=reject at once. Here's how to triage:

Highest priority domains actively sending campaigns: Any domain sending cold email, newsletters, or transactional email is more likely to be spoofed because attackers target domains with recognizable sending reputations.

Second priority domains with existing DMARC at p=none for 90+ days: A domain that's been at p=none for months has had time to collect enough report data to move forward. The audit work is mostly done it just needs someone to look at the reports and take action.

Third priority domains with no DMARC at all: These need a record added first, then the same progression. No DMARC means no reporting and no protection.

For the full checklist of what to audit on each domain, see the complete email domain health checklist for agencies.

---

Frequently Asked Questions

How do I know if someone is spoofing my domain?

The most reliable way is to check your DMARC aggregate reports. If you have a DMARC record with an rua= tag, mail providers send you daily XML reports showing every email sent using your domain including unauthorized ones. Look for records where the source IP is unrecognized and both SPF and DKIM show as failing. That pattern indicates a spoofing attempt. If you don't have DMARC set up, you're not receiving these reports and have no visibility into spoofing activity.

Can someone spoof my domain if I have DMARC?

Yes if your DMARC policy is p=none. That policy collects reports but takes no enforcement action. Spoofed emails are still delivered. To actually block spoofing, your DMARC policy needs to be at p=quarantine (routes to spam) or p=reject (blocks outright). Most domains are stuck at p=none, which means they have DMARC configured but are still fully spoofable.

What is the difference between domain spoofing and phishing?

Domain spoofing is a technique used within phishing attacks. Phishing is the broader category any attempt to deceive someone into revealing credentials or clicking a malicious link. Domain spoofing is the specific method of making the email appear to come from a trusted domain. A phishing email can use domain spoofing (using your exact domain), look-alike domains (registering a similar domain), or display-name spoofing (showing your brand name while using a completely different email address).

How do I stop someone from spoofing my domain?

Move your DMARC policy to p=reject. The safe process: first audit all legitimate sending sources and ensure they pass both SPF and DKIM alignment. Then move to p=quarantine and monitor for 2-4 weeks. Then move to p=reject. Once at reject, unauthorized senders are blocked at the mail server level. Your domain cannot be successfully spoofed in exact-match attacks.

Does SPF alone prevent spoofing?

No. SPF validates the envelope sender (the technical return path), not the From address that recipients see. An attacker can spoof the visible From address while using a different envelope sender that passes SPF. DMARC requires alignment between the From domain and the authenticated domain which is what makes it effective against spoofing. SPF alone is necessary but not sufficient.

How quickly can I detect a spoofing attack?

With standard DMARC aggregate reports, you'd detect it within 24 hours the reports arrive daily. With real-time DMARC report ingestion and alert processing, you can detect it as soon as the first report arrives after the attack begins, which can be within hours. Infraova parses DMARC reports as they arrive and fires alerts immediately when spoofing patterns are detected, rather than waiting for a daily digest.

What should I do if my domain is actively being spoofed?

First, confirm it via your DMARC reports. Then accelerate the move to p=reject audit your legitimate senders, fix any alignment issues, and escalate through quarantine to reject as quickly as safely possible. If the spoofing is targeting your clients or users, notify them directly so they know to ignore emails from your domain that ask for credentials or link to external sites. Document the source IPs from the reports and consider reporting them to the relevant abuse contacts.