"Someone has hacked our email!"

We frequently hear from administrators and users freaked out because their contacts are receiving suspicious email that looks like it's from them or their company — when it most definitely isn't. Usually that bogus email also includes a link that is oddly and irresistibly compelling for the recipient to click. A vague and cryptic message like "Check this out!" or "Some food for thought" can be enough to fool someone.

But here's the thing: your email hasn't been hacked. It's been "spoofed."

What Is Email Spoofing?

Spoofing is a very common way to spread malware. Just like the name suggests, it's when someone imitates your displayed email address or company domain name to trick the email recipient into a response.

That desired response can be anything from getting them to wire a large sum of money, pay an invoice, or click on a link that will load malware on that user's device.

Major well-known companies like FedEx, American Express, and the U.S. Postal Service have been spoofed — and so have a lot of "regular Joes." The bad guys want to cast a wide net and see who they can trick.

Why Is This Possible?

Email was designed decades ago with very little built-in authentication. The "From" field in an email is essentially just a label — by default, nothing in the email protocol verifies that the sender actually controls the domain they claim to be sending from.

This is why spoofing is so prevalent. It requires no access to your email account, no hacking, and no special skills. Anyone with basic technical knowledge can send an email that appears to come from your domain.

So Is There Any Way to Stop This?

The short answer is: "It ain't easy." But there are tools available that can significantly reduce the problem.

The key is that these tools require the recipients' email systems to check and verify the authenticity of the sender. You can't force every recipient's mail server to do this, but most modern email systems do — which means implementing these records will help a lot.

For network administrators, we recommend setting up the following DNS (TXT) records with your DNS service provider:

1. Sender Policy Framework (SPF)

An SPF record tells receiving mail servers which IP addresses are authorized to send email on behalf of your domain. If an email arrives claiming to be from your domain but originates from an unauthorized server, the receiving mail system can flag it or reject it.

2. DomainKeys Identified Mail (DKIM)

DKIM adds a digital signature to your outgoing emails. Receiving mail servers can verify this signature against a public key published in your DNS records. If the signature doesn't match — or is absent — the email can be treated as suspicious.

Together, SPF and DKIM form a strong foundation for email authentication. There's also a third standard, DMARC, which builds on both and gives you reporting on who is sending email using your domain.

What Should You Do?

Don't know what any of that means, but really sick of the spoofing? Contact OTM and we'll help you get these steps implemented. We'd be happy to help.

Setting up SPF and DKIM records is a relatively straightforward process for an experienced IT team, but it does require access to your DNS settings and a clear understanding of your email infrastructure. Getting it wrong can cause legitimate email to be rejected, so it's worth having a professional handle it.

Call us at 800-292-3537 or reach out through our contact page. We'll assess your current email authentication setup and get you protected.

Do you have any spoofing horror stories to share, or any advice to add? We'd love to have your thoughts.