Why Exact-Domain Spoofing Is Still Common, and What Stops It

Email was designed with no check on who is sending, so anyone with a mail server can write your domain into the From line. What stops it is a DMARC policy at enforcement: it tells receiving servers what to do with mail that fails authentication. Without one, much of that forged mail is delivered like any other.

The two ways to impersonate your company

The first uses your exact domain. The message says it comes from accounts@yourcompany.com, and nothing in the inbox looks unusual.

The second uses a lookalike, such as yourcompany-invoices.com or a name with one letter swapped for a similar one. The attacker registers it and authenticates it perfectly well.

Both feed the same kinds of fraud:

• A supplier’s “new bank details”.
• An urgent payment request from the managing director.
• A password reset that is not one.

The FBI’s Internet Crime Complaint Center recorded just over $3 billion in losses to business email compromise in its 2025 annual report, second only to investment fraud.

That figure covers every variant: exact-domain spoofing, lookalike domains and hijacked mailboxes alike. It measures the attack, not any one technique.

What DMARC stops

DMARC closes the first door. Your domain publishes a policy in a TXT record at _dmarc.

Receiving servers check every message that claims to be from you against SPF and DKIM. When a message fails, they apply your policy:

What DMARC cannot stop

DMARC does nothing about the second door. A lookalike domain is a different domain with its own records, and it can pass DMARC on its own terms.

The defences there are different:

• Training people to read the sender’s address.
• Mail filters that flag new or similar-looking senders.
• Watching for registrations that imitate your name.

Why staying at p=none protects nothing

Many domains publish p=none and stay there. It is the right place to start.

At p=none, receivers send you daily reports of who is sending as your domain. Nothing is blocked while you find and fix your own services.

But p=none asks for information. It is not a defence: a forged message that fails every check is still delivered.

Why domains get stuck there

Domains stay at p=none because enforcement feels risky, and the risk is real. If the payroll provider or the invoicing tool has never been set up to authenticate as you, enforcement sends your own mail to spam.

The answer is not to stay where you are. Find those senders in the reports, fix them, then raise the policy in steps while watching what changes.

What the mailbox providers now require

Since February 2024, Google and Yahoo have set rules for bulk senders: those sending around 5,000 messages a day or more to their users. A bulk sender must:

• Publish a DMARC record.
• Authenticate with both SPF and DKIM.
• Align the From domain with at least one of them.

Microsoft set out the same baseline for Outlook.com, Hotmail.com and Live.com addresses, enforced from May 2025. The minimum all three ask for is p=none.

How your subdomains are covered

An attacker does not need your main domain if billing.yourcompany.com will do.

Under DMARC, subdomains follow the main domain’s policy unless the record says otherwise with an sp= tag. A record that publishes p=reject next to sp=none leaves every name under your domain open.

On SentraDMARC, newly added domains publish no sp= tag, so subdomains move up with your policy. Before each of those steps, the readiness check looks at mail sent from your subdomains. Subdomain policy in the docs has the details.

How to get to reject safely

The path is the same for everyone:

1. Publish p=none.
2. Read the reports.
3. Fix your own senders.
4. Raise the policy gradually.

SentraDMARC is built around that path. It names the services sending as your domain and tells you which of yours are failing and why. It offers the next step up only when your own reports support it.

You approve every step, and nothing moves your policy on a schedule. The enforcement ladder in the docs walks through each step.