What is email spoofing? How to stop someone faking your business email address

Email spoofing is when someone sends an email with a forged sender address. It looks as if it comes from someone you trust: your bank, a supplier or even your own business. If you've had replies or bounce messages (notices that an email couldn't be delivered) for emails you never sent, your address may have been spoofed. On its own, that doesn't mean anyone has got into your account.

If you run a joinery business at yourjoinery.co.uk, a spoofed email could show accounts@yourjoinery.co.uk as the sender. The person who sent it has never been near your mailbox. Your email provider can't stop a scammer typing your address into a sender field like that. But you can make those fakes easier to spot and harder to deliver.

How does email spoofing work?

Email spoofing works because SMTP, the standard for sending email, can't check on its own who really sent a message. The sender address is a line of text in the email, a bit like the return address on an envelope. Whoever writes the email can forge the sender name and address in it.

Spoofed emails usually take one of three forms:

• A fake display name, where the name you see says your bank or your boss, while the address behind it belongs to someone else.
• A forged sender address, where the From line or the reply-to address shows a real address, such as accounts@yourjoinery.co.uk, even though the email came from somewhere else.
• A look-alike domain one letter away from the real one, such as yourj0inery.co.uk with a zero in place of the o.

Spammers use spoofing in the hope that an email from a familiar address won't be marked as spam. It's one of several email threats a business meets.

What is business email compromise (CEO fraud)?

Business email compromise is a scam in which criminals pretend to be someone you deal with by email. They then ask for a payment to a new bank account. When the fake sender is a boss or business owner, it's often called CEO fraud, because the email uses that person's authority to rush someone into paying.

At your joinery business, your bookkeeper might get an email from accounts@yourjoinery.co.uk, signed with your name. It says a timber supplier has changed banks and asks them to pay this week's invoice into the new account today.

You protect your business from this scam by never acting on a change of bank details by email alone. Check the old and the new details with the supplier on a phone number you already know, not one from the email. Suppliers rarely change their bank details, so a request to do so is reason enough to pick up the phone.

How can you tell if an email has been spoofed?

A spoofed email can look exactly like one from someone you trust, so check the details rather than the overall look. Look out for these signs:

• The name and the address don't match: open the sender details to see the full address behind the display name.
• The domain is almost right: one letter is swapped for another, so the address resembles one you know.
• The request is urgent: the email pushes you to pay, log in or send details straight away, so you act without thinking.
• Your email program warns you: Gmail shows a question mark next to the sender's name when it can't confirm who sent the email.
• The sender checks don't pass: the email fails SPF or DKIM, the checks that confirm it came from the domain it names.

To check, open the message's full details in your email program, often called the headers or the original message. Look for spf=pass or dkim=pass, which show the email passed SPF or DKIM. A pass doesn't prove the domain it names is the one you expect, so still check its spelling.

If a suspicious email reaches your inbox, don't reply to it, open its attachments or click its links. Forward the email to report@phishing.gov.uk, the free reporting service of the National Cyber Security Centre (NCSC), which investigates the emails it receives. You don't need to forward the ones already in your spam folder.

Someone is sending emails from my address: what should I do?

Start with your Sent folder. If the emails aren't there, your account is most likely fine. Spoofed emails are created outside your mailbox, with your address typed in as the sender, so your email provider can't stop them being sent. What you can do is make them easier for other mail servers to reject, with the records in the next section.

If you find messages there that you don't recognise, someone has got into your account. Change its password, and the password of any other account that uses the same one. Then follow our guide on what to do when your email password has leaked. It's also worth telling your contacts to treat recent emails from you with suspicion.

If anyone lost money because of the emails, report it as fraud. In England, Wales and Northern Ireland, that's Report Fraud, online at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101.

How do you stop people spoofing your business domain?

You can tell other mail servers which emails really come from your domain, so they can spot the fakes. You do that with three records in your domain's DNS settings.

• SPF lists the mail servers that may send email for your domain, so an email from any other server can be rejected or treated as suspicious.
• DKIM adds an invisible signature to every email you send, which shows the receiving server that the email comes from your domain and wasn't changed on the way.
• DMARC tells receiving servers what to do with an email that fails these checks: only monitor it, send it to spam or reject it. With a custom DMARC record, you can also get reports on how your domain is used.

Together they make spoofing your domain harder. They can't stop it completely, because not every receiving mail server checks them. They also only protect your exact domain, so they do nothing against a fake display name or a look-alike domain.

If you use our business email and your domain uses our name servers, most of this is already in place. Your name servers decide where your domain's DNS settings are managed, so in that case you find them in your control panel with us.

1. Leave your MX record as it is. This record tells other servers where to deliver your email, and by default it points to our mail servers.
2. There's nothing to do for DKIM: it is switched on automatically for your email.
3. Check in your DNS settings that our standard SPF record is switched on for your domain, and switch it on if it isn't. Our help guide shows how to add an SPF record.
4. Do the same for our standard DMARC record, which is in the same DNS settings. Here's how to enable our standard DMARC record.
5. Give a change a few hours to become active, as it can take up to 72 hours to reach everyone.

If your domain uses another company's name servers, its DNS records are set at that company, even if you registered the domain with us. Its DNS settings then need one MX record pointing to our mail servers, an SPF record that includes our servers and the DKIM records our support gives you, and you add any DMARC record there yourself. Our help guide has the exact email records for external name servers. That company's support can help if you're not sure where to add them.

Every inbox on our email plans has an address on your own domain, with spam and virus protection built in.

Questions about email spoofing

Can a spam filter stop spoofed emails?

It helps, but some spoofed emails will always get through a spam filter. Every email account with us has a virus and spam filter that updates every hour. Our mail servers also check incoming emails for a DKIM signature, and emails without one often end up in spam. A well-made spoofed email can still get through, so the signs above still matter.

Is email spoofing the same as phishing?

No, although the two often go together. Think of spoofing as the disguise: a fake sender that makes an email look trustworthy. Phishing is the scam itself. Phishing emails try to get your password, card details or a payment, and spoofing helps them look real.

Protect the emails you send

Spotting fakes protects your own inbox, while your domain's records protect the emails you send in your name. Those records are simplest to keep right when your email and your domain's DNS are in one place. With our email on our name servers, DKIM is on from the start. Choose an email plan and set up the addresses you need on your own domain.