Email spoofing happens when someone forges the "From" address on a message so it looks like it came from your business, even though it didn't touch your servers at all. It's one of the most common tricks behind phishing attempts, and it can quietly damage the trust customers have in mail that genuinely comes from you. The fix is a DNS record called DMARC, and setting it up is simpler than it sounds.
How spoofing hurts your business
A spoofed email doesn't need your password or any access to your systems — the attacker just types your domain into the "From" field. If a customer receives a convincing fake invoice or password reset request that appears to be from you, two things happen: the customer may be defrauded, and your reputation takes the hit even though you did nothing wrong. On top of that, mailbox providers that see fraudulent traffic using your domain name may start treating your real, legitimate email with more suspicion too.
How DMARC stops it
DMARC builds on top of two other email authentication records you may already have:
- SPF lists which mail servers are allowed to send email for your domain.
- DKIM attaches a digital signature to outgoing mail that proves it wasn't altered in transit.
DMARC ties these together. It checks that a message passes SPF or DKIM and that the result actually matches the visible "From" domain, then tells the receiving mail server what to do if that check fails: let it through, send it to spam, or block it outright. It's published as a single DNS TXT record on your domain.
DMARC policy levels
| Policy | What happens to failing mail | When to use it |
|---|---|---|
| Monitor only | Delivered as usual; you just get reports | Always start here |
| Quarantine | Sent to the recipient's spam folder | Once your legitimate senders all pass |
| Reject | Blocked before delivery | Once you're confident in your setup |
Setting up your DMARC record
- Log in to wherever your domain's DNS zone is managed — this is your Avalon hosting control panel if your domain is with Avalon.
- Add a new TXT record with the host
_dmarc. - For the value, start with a monitor-only policy pointed at a reporting mailbox you check, for example:
v=DMARC1; p=none; rua=mailto:[email protected] - Save the record and give it time to propagate across the internet.
- After a couple of weeks, check your reports to see which services are sending mail as your domain, and confirm they're all properly authenticated.
- Gradually move the policy from monitor-only to quarantine, and eventually to reject, once you're confident nothing legitimate will be blocked.
Common mistakes to avoid
The most frequent error is publishing a record with a typo in it — a single misplaced semicolon can cause receiving servers to ignore the entire record. The second most common mistake is jumping straight to a blocking policy before confirming every legitimate sender (marketing platforms, invoicing tools, helpdesk software) is properly authenticated, which can cause your own real email to be rejected.
FAQ
Do I need SPF and DKIM before I set up DMARC? DMARC works best when both are already configured, since it relies on at least one of them passing. It's still worth publishing a monitor-only DMARC record even if your SPF or DKIM setup needs work, since the reports will help you find gaps.
Will this slow down or break my email? Not if you start in monitor-only mode. Nothing is blocked until you deliberately move to a stricter policy.
