Apart from SPF, what else can be done to stop hackers from spoofing your company's email addresses?

3 Answers 3


Set up Domain Keys Identified Mail on your own domain. That will digitally sign legitimate outgoing from your domain. More and more email providers are rejecting or flagging spoofed email where legit email is identified with a Domain Key signature.

Your question says, "apart from SPF..." and that's what I answered. However, for others who might use this answer, SPF is another deterrent. It is easy to set up, but has some limitations that should be considered carefully. You probably want to start with a SOFTFAIL policy.

  • 2
    It might be time to also add DMARC. This is the highest voted question on this topic on this site.
    – schroeder
    Commented Jun 11, 2019 at 14:48

There isn't a way to stop email from being spoofed. Anyone can spoof an email. The trick is adjusting your spam filtering to identify spoofed emails. It also depends how email is being spoofed.

  • Spoofed email without authentication - Require authentication before allowing users to send email. Then adjust your spam filter to flag emails sent anonymously so they're delivered to the "Spam" folder. This should provide a sufficient indication to your users to proceed with caution.
  • Spoofed email from an authenticated user - This would indicate an account compromise and should be looked into immediately.

An alternative to adjusting spam filtering would be to use S/MIME to sign emails. Taking it a step further would be educating users how to verify S/MIME certificates. The downside with this technique is it would be administratively heavy. Each user would need to obtain a certificate and have it available in every email client (including browsers when using web access). So to start S/MIME could be used when sending "official" company emails such as those coming from Human Resources and/or Payroll. As your company becomes familiar with this approach, roll it out to the rest of your users.


Education, to ensure that all email users worldwide understand that the From: header can't be relied upon.

  • 3
    That doesn't stop spoofing, it mitigates the effects Commented Nov 22, 2014 at 19:05
  • 4
    The average user doesn't know what headers are, much less that they can be spoofed. The average user won't take the time to learn what headers are, because they're largely irrelevant to their daily experience of reading jokes and viewing family photos. It's hard to educate the masses when they see no practical use of the knowledge. It is up to us to protect those users.
    – phyrfox
    Commented Nov 23, 2014 at 5:15

Not the answer you're looking for? Browse other questions tagged .