How to stop fake emails sent in your company's name (SPF, DKIM and DMARC)

By the FarSec team · Updated 2026-11-06

In short: anyone can send an email that claims to be from your domain unless your domain publishes three DNS records: SPF (which servers may send for you), DKIM (a signature on each message) and DMARC (what receivers should do with mail that fails). In November 2026 we looked at the public email settings of about 70 Pakistani organisations and nearly two in three had no DMARC record or a monitor-only one. The fix is free, needs no new software and usually takes an IT person under an hour, plus a few weeks of watching reports before the final step.

Why this matters: the "new bank account" email

The most expensive email fraud against Pakistani businesses needs no hacking at all. A criminal sends your client or your accounts team a message that looks like it came from you or a supplier: "Please note our new bank account for this month's payment." If the sender address shows your real domain, people trust it. DMARC is what tells Gmail, Outlook and other receivers to reject or quarantine those fakes instead of delivering them.

Check your own domain in two minutes

On any Windows PC, open Command Prompt and run (replace the domain with yours):

nslookup -type=txt _dmarc.yourcompany.com.pk
nslookup -type=txt yourcompany.com.pk

No v=DMARC1 record: no protection. Receivers decide on their own and many fakes get through.
p=none: monitor only. Useful as a first step, but it blocks nothing.
p=quarantine or p=reject: fakes go to spam or are refused. This is the goal.
In the second result, look for exactly one record starting v=spf1. Two SPF records break SPF completely.

Prefer not to do it yourself? Email your domain to [email protected] and we will send back a free one-page check using public information only. Nothing is tested.

Step 1: SPF, list who sends email for you

SPF is one TXT record on your main domain. Include every service that sends as you: your mailbox provider, your website or invoicing software, your newsletter tool.

Microsoft 365: v=spf1 include:spf.protection.outlook.com -all
Google Workspace: v=spf1 include:_spf.google.com ~all
cPanel hosting email: cPanel > Email Deliverability shows the exact SPF record your server needs, with a "Repair" button.

Keep it to one record and no more than 10 DNS lookups. Each include: counts, and so do the includes inside it.

Step 2: DKIM, sign every message

Microsoft 365: Defender portal > Email & collaboration > Policies > Email authentication settings > DKIM. Publish the two CNAME records it shows, then enable signing.
Google Workspace: Admin console > Apps > Gmail > Authenticate email. Generate a 2048-bit key, add the TXT record, then click Start authentication.
cPanel: Email Deliverability shows a DKIM record; install it if it is not marked valid.

Step 3: DMARC, start by watching, then enforce

Add a TXT record named _dmarc on your domain. Start in monitor mode with reports going to a mailbox you read:

v=DMARC1; p=none; rua=mailto:[email protected]; fo=1

Weeks 1 to 2, p=none: read the daily reports. Every legitimate sender you find (billing system, website forms, CRM) must pass SPF or DKIM. Fix the ones that fail.
Weeks 3 to 4, p=quarantine: fakes now land in spam. You can roll in gently with pct=25, then 50, then 100.
After that, p=reject: fakes are refused outright. Add sp=reject so your subdomains are covered too.

The mistake we see most: forgetting your other domains

Many organisations protect the domain their staff email from, but not the domain on their website, an old brand name or a parked domain. Criminals simply use the unprotected one. Every domain you own needs DMARC. A domain that never sends email should say so plainly:

SPF:   v=spf1 -all
DMARC: v=DMARC1; p=reject; sp=reject

Quick self-test

Does every domain you own publish exactly one SPF record?
Is DKIM signing switched on in Microsoft 365, Google Workspace or your hosting?
Is DMARC at quarantine or reject, with sp= set for subdomains?
Does someone read the DMARC reports at least once a week?
Does your accounts team phone the supplier on a known number before changing any bank details?

Want help? FarSec can check your domains for free from public records, and fix SPF, DKIM and DMARC with your IT team as part of a security assessment, under a signed NDA.

Want a second pair of eyes? FarSec checks businesses in Pakistan for exactly these gaps and helps fix them. Email [email protected] and tell us what worries you.