Interested in our Cybersecurity Framework?
Visit our article on how to organise an effective cybersecurity strategy to download a copy of our framework.
Cyber resilience starts before an attack happens.
Having a clear incident response plan helps trustees, leadership teams, and IT managers act with confidence when every minute matters.
Interested in a Free Phishing Security Test?
VirtueUK are partners with KnowBe4, the world's largest security awareness training and simulated phishing platform.
If you're interested in assessing the Phish-prone percentage of your users, contact us to arrange a free simulated phishing attack.
If you're interested in assessing the Phish-prone percentage of your users, contact us to arrange a free simulated phishing attack.
For UK organisations, trust is one of your most valuable assets. Whether you’re communicating with customers, suppliers, employees, donors, stakeholders, trustees, investors, or partners, your email domain is often the first indicator that a message is genuine.
Unfortunately, cyber criminals know this. One of the simplest tactics they use is email spoofing, where they send messages that appear to come from your organisation to trick recipients into transferring funds, changing bank details, sharing sensitive information, or clicking malicious links.
For retailers, spoofed emails can be used to imitate customer service teams, delivery notifications, or promotional campaigns. For charities, they may target donors and supporters. For businesses, they often target finance teams, suppliers, employees, and customers.
Protecting your email domain is therefore a fundamental component of cyber resilience, reputation management, and stakeholder trust.
In this article, we’ll explain how SPF, DKIM, and DMARC work together to prevent email spoofing, highlight the most common mistake organisations make, and outline how VirtueUK helps organisations strengthen their email security.
Why Can Someone Send Emails Using Your Organisation's Domain?
The underlying technology that powers email was designed decades ago, long before modern cyber threats emerged.
By default, email systems do not automatically verify that the sender genuinely owns the domain shown in the “From” address. Without additional protections, a cyber criminal can send a message that appears to come from:
finance@yourorganisation.co.uk
even though it was sent from an entirely different system.
The recipient sees your organisation’s name, logo, and email address, making the message appear legitimate.
This is known as email spoofing, and it is commonly used in:
- Invoice fraud
- Payment diversion scams
- Donor impersonation
- Executive impersonation attacks
- Credential harvesting campaigns
The National Cyber Security Centre (NCSC) specifically recommends implementing anti-spoofing controls such as SPF, DKIM, and DMARC to prevent criminals from sending fraudulent emails using your domain.
The Three Email Security Controls Every Organisation Should Have
Three DNS records work together to verify that email sent from your domain is genuine.
Although they sound technical, their purpose is straightforward: they help other email systems trust messages that really came from you and reject messages that did not.
SPF (Sender Policy Framework)
SPF is a published list of systems authorised to send email on behalf of your domain.
When a recipient receives an email claiming to come from your organisation, their mail system checks whether the sending server appears on your approved SPF list.
If it does not, the message may be flagged as suspicious or rejected.
For organisations, this is particularly important because many businesses use multiple systems to send email on their behalf:
- Microsoft 365
- CRM platforms
- Email marketing platforms
- E-commerce systems
- Customer service platforms
- Event management software
All legitimate sending services must be included in your SPF record.
DKIM (DomainKeys Identified Mail)
DKIM adds a digital signature to every outgoing email.
This signature proves:
- The email genuinely originated from an authorised system
- The content has not been altered during transit
Think of DKIM as a digital seal of authenticity attached to each message.
Without DKIM, recipients have less assurance that messages are authentic and unmodified.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC is the policy layer that ties SPF and DKIM together.
It allows you to tell other email providers what to do when an email fails authentication checks.
DMARC also provides visibility into who is sending email using your domain.
This means you can quickly identify:
- Legitimate senders you’ve forgotten about
- Misconfigured systems
- Unauthorised spoofing attempts
The Most Common DMARC Mistake Organisations Make
Having a DMARC record is not the same as being protected.
DMARC supports three policy settings:
p=none
Monitor only.
Emails that fail authentication checks are still delivered, but reports are generated.
This is useful during the initial deployment phase but offers no enforcement.
p=quarantine
Suspicious messages are directed to the recipient’s junk folder.
This provides a significant increase in protection while allowing monitoring to continue.
p=reject
Messages that fail authentication checks are blocked before delivery.
This provides the strongest protection against domain spoofing.
Many organisations stop at p=none and never move to enforcement.
Unfortunately, this means cyber criminals can continue spoofing the domain.
Industry best practice, including guidance from Microsoft and the NCSC, is to begin monitoring and ultimately progress to p=reject once legitimate email sources have been validated.
What SPF, DKIM and DMARC Cannot Prevent
While these controls are highly effective, they are not a complete defence against impersonation.
Lookalike Domains
Attackers may register domains that resemble yours, such as:
- yourcompany-support.co.uk
- co.uk
- your-business.co.uk
Because the attacker owns these domains, your DMARC policy cannot stop them being used.
Display Name Spoofing
An attacker can send an email from a free Gmail account while displaying:
“Accounts Department”
Recipients who only check the sender name may still be deceived.
This is why staff awareness training remains essential.
At VirtueUK, our cyber awareness solutions help organisations educate staff on identifying suspicious emails, payment fraud attempts, and impersonation attacks.
Why This Matters Beyond Cyber Security
Major email providers now expect domains to use SPF, DKIM, and DMARC. Google and Yahoo introduced stronger authentication requirements for bulk senders in 2024, while Microsoft implemented similar enforcement for Outlook.com, Hotmail, and Live.com senders in 2025. Domains that do not meet these requirements face increased risks of messages being filtered, marked as spam, or rejected.
Whether you’re sending customer notifications, invoices, marketing campaigns, supplier communications, fundraising updates, or internal business correspondence, properly authenticated email is significantly more likely to reach the inbox.
This is particularly important for:
- Customer communications
- Online order updates
- Invoices and supplier interactions
- Staff communications
- Marketing campaigns
- Stakeholder correspondence
- Microsoft 365 communications
How VirtueUK Helps Organisations Secure Their Email
Many organisations assume SPF, DKIM and DMARC are already configured correctly because they use Microsoft 365.
In reality, we frequently discover:
- Missing DMARC records
- Incomplete SPF records
- Third-party systems not covered by authentication
- DMARC policies left at p=none for years
- No monitoring of authentication failures
As part of our Managed Services and vCIO engagements, VirtueUK helps charities:
- Audit existing email security controls
- Implement SPF, DKIM and DMARC correctly
- Configure DMARC reporting and monitoring
- Move safely towards quarantine and reject policies
- Identify unauthorised email sources
- Improve Microsoft 365 security posture
- Support Cyber Essentials and cyber governance requirements
For many organisations, these improvements deliver both stronger protection and improved email deliverability.
How to Check Your Domain
You can perform an initial assessment using the NCSC’s free email security checker or publicly available DMARC testing tools or simply use VirtueUK’s, free on here.
However, simply having records present does not guarantee they are correctly configured.
A typical implementation approach involves:
- Identifying all legitimate email sending services.
- Configuring SPF and DKIM for each platform.
- Deploying DMARC in monitoring mode.
- Reviewing DMARC reports.
- Progressively moving to quarantine.
- Ultimately enforcing a reject policy.
This staged approach reduces the risk of legitimate messages being blocked while improving protection against spoofing.