Someone Spoofing Your Business Email? How to Stop It Now

1. Is Someone Spoofing Your Email or Has It Been Hacked?

Quick Answer: Email spoofing means someone forges your address in the “From” line while sending from their own server. Your mailbox is untouched. Hacking means someone logged in to your real account. If the fake emails are missing from your Sent folder and you see bounces you never caused, it is almost certainly spoofing.

The fixes differ. A hacked mailbox needs a password reset and security review today. A spoofed domain needs DNS changes that tell other mail servers to reject forgeries.

Gmail’s own help article on emails sent from a spoofed address explains that these messages are created outside your email service, so your provider cannot stop the spammer from typing your address. What you can control is what receiving servers do with those forged emails.

Use these quick signs to tell the three situations apart:

• Spoofed exact domain. The email shows your real address, but it is not in your Sent folder, and replies or bounces land in your inbox.
• Lookalike domain. The address is close but not identical, such as an extra letter or “.com” instead of “.com.my”. DNS records on your domain cannot block this.
• Hacked mailbox. The fake emails do appear in your Sent folder, or you see unknown logins and new forwarding rules in your account.

2. Why Is My Business Email Being Spoofed? Causes Ranked

Quick Answer: The most common cause is a domain with no DMARC record at all, so receiving servers have no instruction to block forgeries. Next is a DMARC policy left at “none” after setup, then an SPF record that is missing or ends in a permissive “?all”. Lookalike domains and genuinely hacked mailboxes are less common.

Scammers pick targets that are easy to impersonate, not necessarily big ones. Here is how the root causes break down in the cases we handle:

Records often go missing during a website or hosting move, because a new DNS host starts with an empty zone. If you changed hosts recently and records are not showing yet, see our guide to DNS not propagating after a domain change. If your domain sits behind Cloudflare, add the records in Cloudflare’s DNS panel, not at your old host. If the site itself is timing out there, read our fix for Cloudflare error 522.

3. How Do I Confirm Email Spoofing From the Headers?

Quick Answer: Ask a recipient to forward the suspicious email as an attachment, or open a copy you received. In Gmail, choose More, then Show original. Look at the SPF, DKIM and DMARC results and the sending IP address. A forged email usually shows DMARC “fail” and a server you do not recognise.

Headers are the email’s delivery record. Google’s guide to tracing an email with its full header shows the path: open the message, click More next to Reply, then Show original. Outlook and other apps have a similar “view message source” option.

Compare what you see with these three typical patterns:

Microsoft’s DMARC setup and troubleshooting guide explains that an unknown IP sending high volumes that fails every check is a likely spoofing campaign. Once your DMARC policy is enforced, those messages are blocked for you.

4. How to Stop Email Spoofing on Your Domain, Step by Step

Quick Answer: Secure your real mailboxes first, then check your SPF record, turn on DKIM signing in your email provider, and publish a DMARC record that starts at “none” with a report address. Review the reports, add any missing legitimate senders, then move the policy to “quarantine” and finally “reject”.

Work through these steps in order. Every DNS change is made at the provider your domain’s nameservers point to.

1. Secure the mailboxes. Change passwords for admin and finance accounts, turn on two-step verification, and remove any forwarding rules you did not create. This rules out a hacked account.
2. List every service that sends as you. Include your email provider, website contact form, billing system, e-invoicing software and email marketing tool.
3. Fix SPF. Keep exactly one SPF TXT record that names every legitimate sender and ends in “~all” or “-all”. Two SPF records cancel each other out.
4. Turn on DKIM. In Google Workspace or Microsoft 365, generate the DKIM key in the admin console, add it to DNS, then switch signing on.
5. Publish DMARC at p=none. Add a TXT record at “_dmarc” with a “rua” report address. Google’s Workspace DMARC setup guide advises waiting 48 hours after setting up SPF or DKIM before adding DMARC.
6. Read the reports. Daily aggregate reports list every server sending as your domain. Fix any legitimate sender that fails.
7. Tighten to quarantine, then reject. Move to “p=quarantine”, optionally using “pct” to apply it to a share of mail first, then to “p=reject” once your own emails pass cleanly.

Website forms are the sender most often forgotten. If your enquiry emails start failing once DMARC is enforced, follow our fix for website form emails going to spam. And if your own legitimate email stops arriving after DNS edits, check the MX records with our guide to a business email not receiving messages.

5. How Long Does It Take to Stop Email Spoofing?

Quick Answer: DNS records usually take effect within an hour to a day. The safe DMARC rollout takes longer: about two to four weeks at “none” to collect reports, then one to two weeks at “quarantine” before “reject”. Forged emails start being filtered once quarantine is live, and blocked once reject is live.

There is no appeal queue here. You control the timeline, but rushing it risks blocking your own invoices. The realistic schedule:

Two honest limits apply. First, DMARC depends on the receiving server honouring it; most large providers do, but not every small one. Second, it cannot stop lookalike domains. For those, report the fake domain to its registrar’s abuse contact and warn customers directly.

6. What Should You Tell Customers and Who Do You Report To?

Quick Answer: Tell customers and suppliers the same day that fake emails are using your name, and that you will never change bank details by email alone. Report the incident to Cyber999 by CyberSecurity Malaysia. If anyone has already paid a scammer, they should call the National Scam Response Centre at 997 immediately.

In Malaysia, spoofed emails are mostly used for invoice fraud: a “new bank account” notice sent to your customers or suppliers. The financial damage happens to them, but the reputational damage lands on you. Act quickly on three fronts:

• Warn by a separate channel. Send a short notice by WhatsApp, phone or a post on your website and social pages, not only by email, which the scammer may also be imitating.
• Report the incident. MyCERT’s Cyber999 service accepts reports through its online form, mobile app, email and a 24-hour hotline. Keep the full headers of two or three forged emails as evidence.
• Lodge a police report if money was lost. Victims who transferred funds should call 997 first, then make a police report so the bank can act on it.

Scammers also spoof platform brands to target your marketing accounts. Fake “Meta” warnings often lead to real problems such as a disabled Facebook account or a failed Facebook identity confirmation after someone enters details on a phishing page. Fake “Google” billing emails are a common route to a hacked Google Ads account with unauthorised spend. And if your Google Ads changed by itself, check whether it was simply auto-applied recommendations rather than an intruder.

7. How Do You Prevent Email Spoofing From Coming Back?

Quick Answer: Keep DMARC at “reject”, keep one clean SPF record, sign all mail with DKIM and keep reading DMARC reports monthly. Add a “reject” DMARC record to domains you own but never send email from. Most importantly, own your domain and DNS logins under the company, not a former vendor.

Prevention is mostly about not losing ground after the fix:

• Protect idle domains. Microsoft recommends a “v=DMARC1; p=reject;” record on registered domains that never send email. That includes any old domain now showing a holding page; see our guide to a domain showing a parked page.
• Re-check after every move. When you change website host or DNS provider, copy the SPF, DKIM and DMARC records across the same day.
• Own the accounts. Keep the registrar login under a company email, with SSM details matching the domain record. If a past vendor controls it, our guide to getting your .my domain transfer code explains how to take it back.
• Keep the website trusted too. Customers checking a warning against your website should see a secure site. Fix any SSL protocol error or expired SSL certificate quickly.
• Watch deliverability. Gmail’s email sender guidelines already require SPF, DKIM and DMARC from anyone sending more than 5,000 messages a day, so these records also protect your newsletters.

The difference enforcement makes is clear in the domains we manage:

For broader sending health, our guides on emails landing in spam and sender domain reputation pick up where this one ends.

8. When Should You Escalate to ZenWeb?

Quick Answer: Bring in help if nobody can log in to your domain’s DNS, if your DMARC reports show senders you cannot identify, if moving to “quarantine” breaks your own invoices or forms, or if the fake emails turn out to come from inside your real mailbox. These need hands-on DNS and email work, not more waiting.

Escalate when you see any of these:

• No DNS access. The domain was registered by a former designer and the login is lost.
• Unreadable reports. DMARC aggregate reports arrive as compressed XML files that are hard to interpret without tooling.
• Your own email breaks. Legitimate invoices or newsletters fail once enforcement starts.
• Signs of a deeper breach. Forged emails link to a copy of your website, or your site was hacked too. See our steps to clean a hacked website.

ZenWeb is a Google Partner agency that has worked with 500+ Malaysian businesses. Our web design and website management team sets up domains, business email hosting and email authentication for every site we build, so impersonation is blocked before it starts.

9. Conclusion

Email spoofing feels personal, but it is usually a gap in three DNS records rather than a break-in. Check your Sent folder to rule out a hacked account, read the headers to confirm the forgery, warn customers on a separate channel and report to Cyber999. Then fix SPF, turn on DKIM and take DMARC from “none” to “reject” over a few weeks. For more guides on keeping your business safe and visible online, visit the ZenWeb home page.

10. Frequently Asked Questions

1. Can I stop someone from spoofing my email completely?

You can stop most of it. A DMARC policy set to “reject”, backed by correct SPF and DKIM, tells receiving servers to refuse forged emails using your exact domain. It cannot stop lookalike domains, and a few receiving servers ignore DMARC, so customer awareness still matters.

2. Does email spoofing mean my email account was hacked?

Usually not. Spoofed emails are sent from the attacker’s own server and never touch your mailbox. If the fake emails appear in your Sent folder, or you see unfamiliar logins or forwarding rules, treat it as a hacked account and change passwords immediately.

3. Why am I getting bounce messages for emails I never sent?

A spammer used your address in the “From” line, and the emails were rejected by the recipient’s server, which sent the failure notice back to you. It is a common sign of email spoofing. Publishing a DMARC policy at “reject” reduces these bounces over time.

4. Is it safe to set DMARC to reject straight away?

Only if you are sure every service sending as your domain passes SPF or DKIM. Most businesses have at least one forgotten sender, such as a website form or billing tool. Start at “none”, read the reports for two to four weeks, then tighten.