How to Stop Spam and Spoofing on Business Email

If your business inbox is filling with spam, or worse, clients are getting invoices and messages that look like they came from you but didn’t, you’re facing a decision: how much protection do you actually need, and in what order should you fix things? It’s easy to panic-buy a security add-on that doesn’t touch the real problem. It’s just as easy to do nothing and hope. Neither is the answer.

The good news is that the two issues — spam coming in and your name being forged going out — have well-established fixes, and most of them are configuration rather than expensive software. This guide lays out the options, the trade-offs, and a sensible order of work.

First, separate the two problems

Spam is unwanted mail arriving in your inbox. Annoying, sometimes dangerous, but it’s a filtering problem.

Spoofing is someone forging your email address so their messages appear to come from your business — used to trick your clients, suppliers or staff into paying fake invoices or handing over logins. That’s a reputation and fraud problem, and it’s the one most owners underestimate. A convincing spoofed email from “you” to a client can cost real money and real trust.

They need different tools, so it helps to tackle them separately.

The options, and what each one actually does

Fix	Stops spam coming in	Stops your domain being spoofed	Effort	Cost
Built-in provider filtering (365 / Workspace)	Yes — most of it	No	Low (mostly on already)	Included
SPF, DKIM & DMARC records	No	Yes	Medium (one-off setup)	Free
Dedicated filtering gateway	Yes — heavier cases	Partly	Medium	Monthly per user
Staff awareness & clear payment rules	Some	Reduces the damage	Low, ongoing	Free

A few things stand out from that table. The single most effective anti-spoofing measure — email authentication — is free, because it’s just DNS records you publish for your domain. And the built-in filtering in Microsoft 365 or Google Workspace already handles most inbound spam without you buying anything extra. So the expensive-looking options aren’t where you should start.

Email authentication: the part worth doing properly

Three records do the heavy lifting against spoofing:

• SPF lists which servers are allowed to send email for your domain.
• DKIM adds a tamper-proof signature to every message you send, so receivers can verify it’s really from you.
• DMARC ties the two together and tells the world’s mail servers what to do with anything that fails — nothing, quarantine it, or reject it outright. It also emails you reports on who’s sending as your domain.

Set up correctly, these stop a scammer forging your actual domain, which is the most damaging form of email fraud. Left unset — and a surprising number of small businesses have them missing or half-configured — your domain is an open goal.

The one caution: don’t rush to a strict DMARC policy. Start in monitoring mode, read the reports for a few weeks to find every legitimate system that sends mail as you (your accounts software, your booking tool, your newsletter platform), fix each one, then tighten the policy. Get this order wrong and you’ll bounce your own invoices. This is fiddly, unforgiving work, and it’s the part most worth getting a hand with as part of proper email setup.

Filtering: tune what you have before you buy more

For inbound spam, the built-in filters in 365 and Workspace are strong and improving all the time. Before paying for anything, it’s worth having someone check that the anti-phishing and anti-spoofing settings are actually switched on and tuned — the defaults are decent but not always maximal, and features like impersonation protection are often left off.

A separate filtering gateway is a real product with a real place — heavy targeted phishing, granular quarantine control, or a compliance requirement can all justify one. But for a typical small business, it’s a second step, not a first. Spending on a gateway while your DMARC is unconfigured is fixing the cheaper problem and ignoring the dangerous one.

The human layer

No filter catches everything, and the cleverest scams don’t rely on spam at all — they rely on a plausible email and a rushed member of staff. Two simple rules cut most of the risk: never act on a change of bank details from an email alone (always confirm by phone on a known number), and treat any urgent payment request as a prompt to slow down, not speed up. That habit, backed by the technical fixes above and sensible cyber security basics, is what keeps invoice fraud out.

The recommendation

For most businesses, the right order is clear:

1. Publish and configure SPF, DKIM and DMARC — free, and the only thing that stops your domain being spoofed.
2. Tune the filtering you already pay for in 365 or Workspace before buying anything new.
3. Set two payment-verification rules and make sure staff know them.
4. Add a filtering gateway only if targeted phishing or compliance genuinely calls for it.

Do the first three and you’ve closed the gap that causes most email fraud, at almost no cost beyond an afternoon of careful setup.

If you’d rather not wade through DNS records and DMARC reports yourself, we’re happy to check your domain, get authentication set up properly and tune your filtering — so scammers can’t wear your name and your inbox stays quiet. Get in touch and we’ll take a look at how your email is set up today.