A convincing email sent in your company’s name can do damage before you even know it exists. A criminal may pose as your accounts team to request a bank-detail change, imitate a director to pressure a colleague into making a payment, or send customers a realistic-looking phishing link from an address that appears to use your brand. This is email spoofing, and it is a practical fraud, trust and reputation risk for every UK small business.
The good news is that a basic check does not require a cyber-security team or expensive software. The National Cyber Security Centre (NCSC) provides a free Check your cyber security service for UK organisations. Its email check uses publicly available information to identify whether a domain has important anti-spoofing and email-privacy protections in place. It is a valuable starting point, but the real benefit comes from acting on the results in a careful order.
That matters because email-based attacks remain persistent. In the UK government’s 2025/2026 Cyber Security Breaches Survey, phishing was the most common type of breach or attack reported by businesses, and people impersonating an organisation or its staff was also reported by businesses. Read the full government survey for the wider picture. Here is how to check your domain, understand the findings and prioritise the fixes without accidentally stopping legitimate business email.
What email spoofing is and why it matters
Email spoofing is when an attacker makes a message look as though it came from a trusted sender or domain when it did not. The recipient may see a familiar display name, such as “Brighton Office Supplies Accounts”, and an address that appears close to, or sometimes exactly like, the genuine business domain.
There are two common patterns. In the first, the criminal uses a lookalike domain, such as brightonofficesupplies.co.uk instead of brighton-office-supplies.co.uk. Technical domain protections cannot prevent every lookalike registration, so staff and customers still need to check requests carefully.
In the second, and more dangerous, pattern, the attacker tries to send mail that claims to be from your real domain, such as accounts@yourbusiness.co.uk. Proper email authentication makes it much harder for receiving services to accept those messages as genuine. It also helps your legitimate emails reach inboxes rather than being treated as suspicious.
The consequences are wider than a single fake invoice. Customers may disclose payment or login details, suppliers might change bank information, and your staff can lose time responding to worried recipients. If people believe your business sent the message, confidence in your brand can fall quickly. The NCSC explains that anti-spoofing controls help protect the people and organisations you deal with, as well as your reputation and the costs associated with email fraud. See the NCSC’s email security and anti-spoofing guidance.
Start with the NCSC’s free email security check
The NCSC tool is designed to be accessible to non-technical organisations. You do not need to install software, hand over mailbox access or provide personal details. It checks information that is already public in your domain’s internet settings.
How to run the check
- Go to the NCSC Check your cyber security service.
- Select the email option and enter your domain name, for example yourbusiness.co.uk. Do not enter an individual email address such as hello@yourbusiness.co.uk.
- Review the results for anti-spoofing and email privacy. Save a copy or make a short list of the actions shown.
- Repeat the check for every domain your business owns, including domains used for campaigns, old brands and domains that redirect to your main website.
- Give the results to the person who manages your domain name system (DNS), email platform or external IT support provider if that is not you.
The check is an exposure review, not a verdict on whether your business has been hacked. It cannot inspect the contents of your inbox, find every malicious message or tell you whether a particular sender is a scammer. Its purpose is to show whether the public settings that help prevent forgery and protect mail in transit are present and configured sensibly.
Do not be reassured merely because you use Microsoft 365 or Google Workspace. Large cloud email providers offer strong capabilities, but your business still needs to switch on the relevant protections and publish the correct DNS records for its own domain. The NCSC specifically advises organisations to protect all their domains, including where they use common cloud email providers.
Understand the two areas the tool checks
Anti-spoofing concerns whether other mail systems can verify that an email claiming to be from your domain was sent by an approved service. The central standards are SPF, DKIM and DMARC.
Email privacy concerns protection while messages travel between mail servers. The check can highlight relevant Transport Layer Security (TLS) and related email-transport configuration issues. This is important, but it is not the same thing as end-to-end encryption of a message’s contents. Treat any privacy issue as a separate improvement workstream alongside spoofing protection.
Before changing DNS, build an email-sender inventory
The most common implementation mistake is to update a record based only on the mailbox service people use every day. Modern small businesses often send email from many systems, and an omitted service can cause genuine messages to fail authentication once policy becomes stricter.
Make a simple inventory before asking anyone to change DNS. Include your main email platform, website contact-form notifications, e-commerce order confirmations, accounting and invoicing software, customer relationship management tools, helpdesk platforms, booking systems, payroll services, document-signing tools, scanners and multifunction printers, plus email marketing providers. Ask sales, marketing, finance and operations, not only IT. A newsletter service set up years ago by a former colleague is still a legitimate sender if it is active.
For each service, record the sending domain or subdomain, the business owner, whether it sends on your behalf, and the supplier’s current instructions for SPF and DKIM. Keep this document. It will make future supplier changes and annual reviews far less risky.
A useful example is a plumbing firm that sends normal person-to-person mail through Microsoft 365, invoices through accounting software and appointment reminders through a booking platform. If it configures protection only for Microsoft 365, its invoices or reminders may later fail checks. If it enables enforcement before discovering that gap, customers could miss a legitimate payment request. Inventory first; enforce later.
Prioritise the technical fixes: SPF, DKIM and DMARC
These three standards work together. They are published as DNS records, which means changes are normally made through the company that manages your domain name, a website host, an IT provider or a managed DNS provider. If you are not confident, ask a qualified provider to implement them and give you a written record of the changes.
1. SPF: list the services allowed to send
Sender Policy Framework, or SPF, lets a domain owner publish the email servers and services authorised to send mail for that domain. A receiving email service can compare the sending source with that published list. The NCSC describes SPF as a way of publishing the IP addresses that should be trusted for a domain. Read the NCSC’s SPF implementation guidance.
Your priority is completeness and maintenance. Use the exact SPF value supplied by each legitimate provider; do not copy an example record from another organisation. Combine authorised services into the one SPF record for the domain rather than creating competing SPF records. Be alert to technical limits as the number of suppliers grows: complex SPF configurations can exceed the permitted DNS lookup limit. This is another reason to keep the sender inventory current and consider dedicated subdomains for high-volume third-party mail.
SPF alone is not enough. It does not give you a clear instruction to recipient mail systems about how to treat a failed message, and forwarding can complicate SPF checks. That is why DKIM and DMARC are essential companions.
2. DKIM: sign the email you send
DomainKeys Identified Mail, or DKIM, attaches a cryptographic signature to outbound mail. Receiving services can use the public part of the key published in DNS to check that the message was signed by an authorised sender and was not altered in transit. It is especially useful for third-party systems that send branded mail, such as marketing, customer-support and invoice platforms.
Turn on DKIM in your main email platform and in every supplier that supports custom-domain signing. Each supplier will provide a selector and DNS record value. Follow its current documentation rather than relying on a screenshot or old support ticket. After publishing the record, send test messages to accounts at more than one major provider and check the authentication results if your mail service makes them available.
3. DMARC: monitor first, then enforce
Domain-based Message Authentication, Reporting and Conformance, or DMARC, brings SPF and DKIM together. It lets your domain state what a receiving server should do when a message claiming to be from you fails the relevant checks. It also provides reports that reveal which systems are sending mail using your domain.
DMARC should be introduced in stages, not treated as a one-click fix. The NCSC recommends beginning with a monitoring policy, commonly shown as p=none. This does not change delivery, but it provides reports so you can find legitimate senders, configuration errors and potential spoofing. Follow the NCSC’s guidance on starting DMARC in monitoring mode.
Review the reports with your IT provider or a DMARC-reporting service. Fix every known genuine sender that fails alignment or authentication. Only when you are confident that legitimate sources are correctly configured should you move progressively to quarantine, which asks receivers to treat failures as suspicious, and then reject, which asks them to refuse them. The NCSC’s phased plan ends with a reject policy and regular health checks. See the recommended NCSC implementation plan.
Apply DMARC to domains you do not use for email too, including parked domains. Attackers can use an inactive domain because it still resembles your brand. A monitoring or enforcement policy on those domains reduces an unnecessary impersonation opportunity.
Do not overlook account security
Domain authentication protects your name from being forged; it does not stop a criminal who has obtained a real employee’s mailbox password. A compromised account can send authentic email, view conversations, reset passwords for other services and create convincing payment fraud.
Make multi-factor authentication mandatory for every email account, particularly administrators, finance staff and directors. Use unique, long passwords stored in an approved password manager, remove old accounts promptly, and restrict administrator rights to the smallest number of people necessary. Review mailbox forwarding rules, delegated access and third-party application permissions, since attackers often create hidden rules to keep receiving copies of messages.
Pair technical measures with a short, clear payment-verification procedure. No request to change supplier bank details, payroll details or payee information should be actioned solely on the basis of an email. Confirm it through a known telephone number or established contact route, not a number included in the message. Train staff to report rather than simply delete suspicious emails so you can spot a pattern early.
Make domain checking a routine, not a one-off task
Re-run the NCSC check after significant email or DNS changes and schedule a regular review, such as every quarter. Revisit the sender inventory when your business adds a new software platform, changes an agency, launches a campaign subdomain or moves email provider. Also confirm that DMARC reports are still reaching a monitored mailbox or reporting service.
If customers report fake messages, preserve examples with their headers where possible, alert affected customers through a trusted channel, review your DMARC reports and check for suspicious mailbox rules or logins. Staff and customers can forward suspicious emails to the NCSC’s Suspicious Email Reporting Service at report@phishing.gov.uk. If you believe a business account or system has been compromised, use the NCSC’s incident-reporting guidance and involve your IT provider quickly.
Take the first step today
Email spoofing is not just an enterprise problem, and protecting a small business domain does not have to begin with a complicated project. Run the free NCSC check, list every service that sends mail in your name, and use SPF, DKIM and DMARC in a controlled sequence. Combine those controls with multi-factor authentication and payment verification, and you will make it substantially harder for criminals to misuse the trust your customers place in your business.
