Protecting your company against email spoofing and CEO fraud
The email arrives from bogholderi@yourcompany.dk, asks accounting to change a supplier's bank account, and looks exactly right — because the domain IS yours. Direct-domain spoofing is the cheapest attack in the criminal toolbox, and if your DMARC policy is missing or at p=none, nothing stops it.
How the fraud actually works
CEO fraud and invoice fraud rarely involve hacking anything. The attacker sends mail with your domain in the From header from their own infrastructure. Without DMARC enforcement, receiving servers have no instruction to reject it — the mail lands, the display name says your CFO, and a busy employee wires the money. Danish police have warned about exactly this pattern for years; SMBs are preferred targets precisely because large enterprises locked their domains down first.
The same weakness burns you outward: criminals spoofing your domain at your customers (fake invoices with changed account numbers) destroy trust you spent years building — and you will not even know it is happening without DMARC reports.
The fix is three DNS records
SPF listing your real senders with -all, DKIM signing at every service, and DMARC stepped up to p=reject. At reject, Gmail, Outlook and other receivers that honour DMARC refuse direct spoofs of your domain or send them to junk. Add p=reject with sp=reject on parked domains you own but never send from — spare brand domains are attacker favorites.
What enforcement cannot stop: lookalike domains (yourcompany-dk.com) and display-name tricks. Those need staff awareness and, for the lookalikes, monitoring — but eliminating exact-domain spoofing removes the most convincing weapon and is entirely within your control, today, for the cost of an afternoon.
Check where you stand in five seconds with the free scan; the staged path to p=reject is covered in our enforcement guide.
Free tools that help
- DMARC Inspector: Parse and grade your DMARC policy, reporting addresses and alignment settings.
- DMARC Record Wizard: Answer a few questions and get a copy-ready DMARC record with DNS instructions.