Email spoofing means forging who a message is from. When the forger uses your exact domain, a DMARC record at p=reject makes receivers refuse it. Lookalikes such as examp1e.com and fake display names like "CEO Jane Smith" are different: they never use your domain, so your DMARC record cannot see them.
That split decides where your effort goes. Our scan of the Tranco top 1,000 domains on 19 October 2026 found 396 of them still open to the first kind: 278 had no DMARC record and 118 had p=none. This page explains each attack, what DMARC does and does not cover, and what to do about the rest.
Why spoofing works at all
SMTP, the protocol that moves email, accepts whatever the sending server writes in the From: header. Nothing in the protocol checks it.
SPF and DKIM were added later, but neither one looks at the From address the reader sees. SPF checks the envelope sender. DKIM checks whichever domain signed. An attacker can pass both for a domain they own while showing your domain in From. DMARC (RFC 7489) is the piece that ties the result back to the visible From domain through alignment, and lets you tell receivers to reject mail that fails.
The three kinds of spoofing
| Attack | What the recipient sees | Stopped by DMARC at reject? |
|---|---|---|
| Exact-domain | From: Finance <ap@example.com> sent by an attacker |
Yes |
| Lookalike domain | From: Finance <ap@examp1e.com> or ap@example-billing.com |
No |
| Display name | From: "Example Finance" <randomuser@freemail.test> |
No |
Exact-domain spoofing
The attacker uses your real domain in From. To the reader, nothing looks wrong, because nothing is wrong with the address. This is the attack DMARC was built for. With p=reject, a receiver that checks DMARC refuses the message because neither SPF nor DKIM passes for an aligned domain.
It also covers domains you never send mail from. Of the 1,000 domains in our scan, 199 had no MX record and no DMARC record either. Parked and CDN domains are just as easy to forge as your main one.
Subdomains count as well. A DMARC record can set sp=none for subdomains while the parent sits at reject. 32 of the 603 domains at quarantine or reject in our scan did exactly that, which leaves anything.example.com open to forgery. Another 10 used pct= below 100, asking receivers to apply the policy to only part of the failing mail. RFC 9989, which replaced RFC 7489 in May 2026, drops pct altogether in favour of a t=y test flag, so a partial percentage has no defined meaning in the current standard.
Lookalike domains
The attacker registers a domain that reads like yours: a swapped character (rn for m, 1 for l), an extra word (example-invoices.com), a different top-level domain or an internationalized name with look-alike letters. They then publish their own SPF, DKIM and DMARC, so their mail passes every check. DMARC is doing its job. It just has nothing to say about a domain you do not own.
Display-name spoofing
Most mail apps show the display name and hide the address, especially on phones. So "Jane Smith, CEO" <jane.smith.ceo@freemail.test> looks like Jane on a small screen. The domain is honest. The name is the lie. Again, DMARC passes or fails on the freemail domain, not on yours.
Compromised accounts
A fourth case is not spoofing but ends the same way. If an attacker logs in to a real mailbox, at your company or at a supplier, their mail is genuine as far as SPF, DKIM and DMARC can tell. The FBI's definition of business email compromise includes this: the scam "is frequently carried out when an individual compromises legitimate business or personal email accounts through social engineering or computer intrusion".
What business email compromise costs
The FBI Internet Crime Complaint Center's public service announcement I-091124-PSA, published on 11 September 2024, covers October 2013 to December 2023:
- Domestic and international incidents: 305,033
- Domestic and international exposed dollar loss: $55,499,915,582
- Total U.S. exposed dollar loss: $20,089,561,364
- A 9% increase in identified global exposed losses between December 2022 and December 2023
The same PSA reports BEC in all 50 U.S. states and 186 countries, with UK and Hong Kong banks often used as the first stop for stolen funds. If money has already left, the FBI's words are "time is of the essence": call your bank, request a recall, and file at ic3.gov.
The PSA does not split those dollars by technique. Some came from forged domains, some from lookalikes, many from hijacked mailboxes. So the controls below are grouped by attack rather than by product.
What DMARC stops and what it does not
DMARC at quarantine or reject stops:
- Forged mail using your exact domain in From, at receivers that check DMARC
- Forged mail from your subdomains, when
sp=is notnone - Forgery of domains that never send mail, if they publish
p=reject
DMARC does not stop:
- Lookalike domains, which have their own valid authentication
- Display-name spoofing from any other domain
- Mail sent from a compromised real account
- Spoofing at receivers that do not check DMARC
DMARC also gives you something besides blocking: aggregate reports. Receivers that support reporting, usually once a day, send XML files showing which IPs sent mail using your domain and whether it passed. That is how you find the forwarding service, the forgotten CRM and the attacker before you move to reject.
How many big domains still allow exact-domain spoofing
From our 19 October 2026 scan of the Tranco top 1,000:
| Group | No DMARC record | p=none |
Open to exact-domain spoofing |
|---|---|---|---|
| All 1,000 domains | 278 | 118 | 396 (39.6%) |
| 688 domains with an MX record | 79 | 101 | 180 (26.2%) |
One more domain published a record with no p= tag, which is invalid. The rest were at enforcement: 435 at reject and 168 at quarantine across all 1,000, or 60.3%. Among domains that receive mail, enforcement was higher at 73.8%.
p=none is a monitoring setting. It asks receivers to report, not to act, so a spoofed message is handled as if there were no DMARC at all. Sitting at none for years is the most common way an organization ends up with DMARC "done" and no protection.
BIMI: a visible reward for enforcement
BIMI lets a receiver show your logo next to authenticated mail. It does not block anything. But it requires enforcement first. The BIMI Group implementation guide says the DMARC policy "MUST be at enforcement on the organizational domain and subdomains" and that "'None' policies or 'pct' less than 100 percent are not accepted."
In our scan, 160 of the 688 mail domains published a BIMI record, and 157 of those were at quarantine or reject. PayPal's record, read on 19 October 2026, points to an SVG logo and a certificate file:
$ dig +short TXT default._bimi.paypal.com
"v=BIMI1; l=https://www.paypalobjects.com/marketing/web/logos/paypal_ppe.svg; a=https://www.paypalobjects.com/marketing/web/logos/PPE_UK_DE_paypal_inc.pem"
Check a domain's BIMI record and logo with the BIMI checker.
Anti-spoofing checklist
Your domains (exact-domain spoofing)
- List every domain and subdomain you own, including ones that never send mail.
- Publish SPF and DKIM for every service that sends as you. Check them with the SPF checker and DKIM checker.
- Publish DMARC at
p=nonewith arua=address. Build it with the record generator. - Read the aggregate reports for two to four weeks. The DMARC analyzer parses them in your browser.
- Fix or retire every legitimate source that fails alignment.
- Move to
p=quarantine, thenp=reject. Setsp=rejectand remove anypcttag below 100. - Give non-sending domains
v=spf1 -allandv=DMARC1; p=reject.
Lookalike domains
- Register the obvious variants of your main domain: common typos and the main top-level domains.
- Watch new domain registrations and certificate transparency logs for names close to yours.
- Get takedowns started quickly when a lookalike starts sending.
Display names and compromised accounts
- Tag mail from outside the organization with a visible banner.
- Flag inbound mail that uses an executive's name from an external address.
- Require a phone call to a known number before changing any supplier's bank details or approving an urgent payment.
- Turn on multi-factor authentication for every mailbox, so a stolen password alone does not hand over an account.
DMARC+ runs the domain side of this as a phased rollout from p=none to quarantine to reject, with a 14-day trial. The checklist works with any tool.
Next step
Run each domain you own through the DMARC checker today. Any result of "no record" or p=none is open to exact-domain spoofing right now. Start with the domain your finance team sends invoices from, since a payment request is only convincing when that address is trusted.