Email Spoofing Explained (and How SPF/DMARC Stop It)

Email spoofing is when someone forges the visible From: address so a message looks like it came from you@yourdomain.com — even when it never touched your MailShrine servers. Receivers decide whether to trust that claim using SPF, DKIM, and DMARC.

2FA will not stop spoofing. Account takeover and domain spoofing are different fires — see 2FA for business email and compromised mailbox response.

Real-life example: Harbor Freight Brokers

Chioma runs a clearing agency in Apapa. A client got an “updated bank details” mail that showed accounts@harborfreight.ng. Chioma’s password was fine — attackers never logged in. They simply sent from elsewhere using her domain in the header.

Fixing it meant publishing clean SPF + DKIM, then DMARC starting at p=none. Within two weeks, spoof attempts started failing alignment at Gmail and Yahoo.

Spoofing vs. a hacked mailbox

How the three records work together

Deep dive: SPF vs DKIM vs DMARC · SPF setup · DKIM setup · DMARC for SMBs.

Step 1: Confirm MailShrine is your real sender

Copy the exact SPF include and DKIM CNAMEs from your MailShrine domain settings. Wrong includes = legitimate mail fails later when you enforce DMARC.

Step 2: Publish one SPF TXT (flat, under 10 lookups)

Keep a single SPF record. If you also send from a CRM or payment tool, add those includes before you leave p=none.

Step 3: Enable DKIM signing

Turn on domain DKIM in MailShrine, add the host/value pairs at your DNS host (DNS-only on Cloudflare), then send a test to Gmail and open “Show original.”

Step 4: Start DMARC at `p=none`

Example shape:

• Host: _dmarc
• Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Watch reports for 1–2 weeks, then move toward quarantine / reject using the DMARC ladder.

Step 5: Retest spoof resistance

Send a deliberate external test (or use a reputable checker) that tries to use your From domain without your signature. Soft fail SPF alone is not enough; you want DMARC policy biting.

Checklist

• Single SPF covering MailShrine (+ known ESP includes)Completed
• DKIM pass on real outbound mailCompleted
• _dmarc live at p=none with monitored ruaCompleted
• Tighten to quarantine/reject when reports are cleanNot completed
• Staff know spoofed mail ≠ “we got hacked” automaticallyNot completed

Common mistakes

1. Multiple SPF TXT records.
2. Jumping to p=reject while marketing tools still send unsigned.
3. Assuming Microsoft/Google “branded mail” UI means you are protected without DMARC.
4. Ignoring spam folder causes after broken SPF.

Next steps

• DMARC for small business · Verify DNS at registrars · Secure logins with 2FA

Citations & References

• Reference: RFC 7489: Domain-based Message Authentication (DMARC)
• Reference: Google: Email sender guidelines
• Reference: M3AAWG / industry sender best practices overview via Google

Written by Daniel K., Email Authentication Specialist. Daniel translates SPF/DKIM/DMARC into checklists operators can finish in one DNS session.