In short
Spoofing a domain means sending emails that appear to come from it. There are four ways: using exactly your domain as the sender (stopped by DMARC at p=reject), a misleading display name with another address, registering a lookalike domain (yourcompany-uk.com), or using a real compromised account. DMARC only stops the first. The other three are caught by analyzing every inbound email and teaching users to verify unusual requests.
The four kinds of spoofing
| Kind | Example | What stops it |
|---|---|---|
| Exact domain | From: ceo@yourcompany.com, sent from someone else's server | DMARC at p=quarantine or p=reject |
| Display name | "Your Company CEO" <yourcompany.ceo@gmail.com> | A filter that compares internal names with external senders |
| Lookalike domain | yourcompany-uk.com, yourcornpany.com (rn instead of m), yourcompany.co | Sender analysis and monitoring of new registrations |
| Real compromised account | A supplier's real address, used by an attacker | Behavior analysis and out-of-band verification |
Stop people using exactly your domain
Without DMARC, anyone can send an email with From: you@yourcompany.com from any server, and many receivers deliver it. With DMARC at p=reject, Gmail, Outlook and most servers reject it because neither SPF nor DKIM matches your domain.
The safe path is to start at p=none, read the reports to find every service sending on your behalf, and move to p=reject over a few weeks. Step by step in set up SPF, DKIM and DMARC in cPanel.
Protect domains that never send email too: an SPF record of v=spf1 -all and DMARC at p=reject stop them being used to impersonate you.
Reject inbound spoofing on cPanel
DMARC protects your domain on other people's servers. To protect your own users from emails spoofing third parties, the cPanel server has to check what it receives:
- Reject SPF failures, in WHM › Exim Configuration Manager › ACL Options, rejects mail that the domain's SPF explicitly doesn't authorize.
- SpamAssassin adds points to mail that fails SPF or DKIM.
- Emails claiming to come from your own domain but arriving from outside the server are a strong sign of internal impersonation, typical of BEC fraud.
These rules only catch exact-domain spoofing. Lookalike domains and compromised accounts pass SPF, DKIM and DMARC normally.
Lookalike domains
A lookalike domain is cheap and takes minutes to set up with its own SPF, DKIM and DMARC, so its emails pass every check. The most common variants:
- Swapped or doubled letters: yourcompanny.com, yourcompay.com.
- Letters that look alike: rn for m, l for i, 0 for o.
- Hyphens and extra words: yourcompany-uk.com, yourcompany-payments.com.
- A different ending: yourcompany.com instead of yourcompany.co.uk, or .eu instead of .com.
To defend yourself: register the most obvious variants of your domain, watch for new registrations with tools like dnstwist, and use a filter that analyzes the sender of each email, not just its authentication.
What users should check
- The sender's full address, not just the display name. On a phone you have to tap the name to see it.
- Whether the reply address differs from the sender's.
- Payment requests, bank detail changes or requests for data: always confirm by phone, using a number you already have.
- How to see the technical details: how to read email headers.
How a filter with impersonation detection helps
Clisec validates SPF, DKIM and DMARC on every inbound email, rates the reputation of the sender's domain and IP, detects impersonation and compares each message against the sender's and recipient's usual behavior. It does this at the SMTP layer, before delivery, for every account on the cPanel server and with no MX record changes.
Frequently asked questions
What is domain spoofing?
Sending emails that appear to come from a domain you don't own, whether by using exactly that domain, a misleading display name or a lookalike domain.
Does DMARC stop all spoofing?
No. DMARC stops people using exactly your domain as the sender. It doesn't stop lookalike domains, misleading display names or compromised real accounts.
I got an email from my own domain that I didn't send. What do I do?
Check the headers: if DMARC fails, it's spoofing from outside and you should tighten your DMARC policy. If it passes, an account on your domain may be compromised.
How do I know if someone registered a domain similar to mine?
Tools like dnstwist generate the possible variants and check which ones are registered. Some services alert you automatically when a new one appears.
Protect inbound email on your whole server
Clisec detects impersonation in inbound email for every account on your cPanel server, with no MX changes.