Why Your Business Email is Probably Being Spoofed Right Now — And What Your IT Provider Should Be Doing About It

Imagine receiving an email that looks exactly like it came from your CEO, your accountant, or a trusted supplier — asking you to transfer funds or share login credentials. You check the sender’s name. It matches. You check the email address. It looks right. You action it.

This is not a hypothetical. Business Email Compromise (BEC) cost businesses $2.9 billion in 2023 alone, according to the FBI’s Internet Crime Complaint Center — making it one of the costliest forms of cybercrime tracked. And in most cases, the attack didn’t require hacking into anyone’s system. The attacker simply spoofed the email address — made it look like it came from someone you trust.

The uncomfortable truth? If your business hasn’t configured SPF, DKIM, and DMARC, your domain can be spoofed by anyone, right now, with no special skills required.

What Is Email Spoofing?

Email spoofing is when someone sends an email that appears to come from your domain (e.g. invoices@yourcompany.com) without actually having access to your email system. It’s surprisingly easy to do — the basic email protocol (SMTP) was never designed with security in mind, and by default it places no restrictions on who can claim to be sending from your domain.

This means a scammer can send thousands of emails that look like they came from you — to your clients, your staff, your suppliers — and there is nothing stopping them unless you have the right protections in place.

The Three Email Authentication Controls Every Business Needs

1. SPF — Sender Policy Framework

SPF is a DNS record that tells the world which mail servers are authorized to send email on behalf of your domain. Think of it as an approved sender list — if an email arrives from a server that isn’t on the list, receiving mail servers know something is wrong.

• Without SPF: Anyone can send email claiming to be from your domain.
• With SPF: Receiving servers can identify unauthorized senders and treat them accordingly.

2. DKIM — DomainKeys Identified Mail

DKIM adds a digital cryptographic signature to every email you send. It works like a wax seal on a letter — the recipient’s mail server can verify that the email genuinely came from you and hasn’t been tampered with in transit.

• Without DKIM: Emails can be intercepted and modified without detection.
• With DKIM: Tampering can be detected by the receiving server.

3. DMARC — Domain-based Message Authentication, Reporting and Conformance

DMARC is the policy layer that sits on top of SPF and DKIM. It tells receiving mail servers what to do when an email fails authentication — ignore it, quarantine it (send to spam), or reject it outright. It also sends you reports so you can see who is sending email on behalf of your domain.

• Without DMARC: Even with SPF and DKIM in place, there is no enforceable policy — spoofed emails can still reach inboxes.
• With DMARC: You set the policy. Failed emails are quarantined or rejected by receivers that honour it, and you get visibility into attempts to abuse your domain.

Important update for 2024 and beyond: Google and Yahoo now require DMARC to be in place for bulk email senders. If your business sends newsletters, automated notifications, or marketing emails and you don’t have DMARC configured, your emails may be rejected or sent to spam by Gmail and Yahoo Mail recipients.

Why This Is a Business Problem, Not Just an IT Problem

The impact of email spoofing goes well beyond a security checkbox. Consider:

• Client trust: If your domain is used to send phishing emails to your clients, the reputational damage can be severe — even though you were the victim.
• Email deliverability: Without proper authentication, your legitimate emails are more likely to land in spam, affecting sales, invoicing, and day-to-day communication.
• Compliance: Depending on your industry, failure to secure email communications may carry regulatory implications.
• Financial loss: Invoice fraud and payment redirection scams rely almost entirely on spoofed email — your clients could be defrauded using your name.

This is not a problem reserved for large enterprises. Small and mid-sized businesses are frequently targeted precisely because attackers assume their email security is weak — and they’re often right.

Questions to Ask Your IT Provider Today

If you are not sure whether your business is protected, here are the questions to put to your MSP or IT provider:

1. Have you configured SPF, DKIM, and DMARC for all of our domains — including any domains we own but don’t actively use for email?

2. What is our current DMARC policy? Are we in monitor mode (p=none), quarantine, or reject? If we’re still on monitor mode, what is the timeline to move to enforcement?

3. Are you monitoring the DMARC reports? What would you do if you saw unauthorized senders using our domain?

4. Are all our email-sending services covered? Not just our main email, but CRM tools, accounting software, marketing platforms, and any third-party services that send email on our behalf all need to be included in SPF records.

5. When did you last audit our SPF and DKIM records? These need to be updated whenever a new email-sending service is added.

A good MSP should be able to answer all of these clearly and confidently. If they can’t, it may be time for a review.

What Proper Email Authentication Looks Like

When all three controls are correctly configured and enforced, here’s what happens:

• A spoofed email claiming to be from your domain arrives at a recipient’s mail server
• The mail server checks your SPF record — the sending IP is not on your approved list
• The DKIM signature is missing or invalid
• Your DMARC policy says “reject” — receiving servers that honour it drop the email before it reaches the inbox

Your client never sees it, and you receive a DMARC report showing the attempt.

That’s what good email security looks like. Getting there is not complex for a competent IT provider — but it does require someone who knows what they’re doing and keeps it maintained as your environment changes.

The Bottom Line

SPF, DKIM, and DMARC are not optional extras or advanced features reserved for large corporations. They are foundational email security controls that every business with a domain should have in place. The cost of configuring them is low. The cost of not having them — in fraud, reputational damage, and lost business — can be devastating.

If you are unsure whether your business is protected, the best time to find out is before an attack, not after.

DVG Systems offers a no-obligation email security assessment for Northern Ontario businesses. We’ll check your current SPF, DKIM, and DMARC configuration, identify gaps, and give you a clear picture of where you stand — with no pressure and no jargon.

Get in touch today to book your assessment.