What Spoofing Is and How to Add Protection From It to Google Workspace (DMARC Record)

Quick and easy-to-follow guide for Google Workspace administrators

How to know if you are getting spoofed

You are getting spoofed if you:

Get bounce messages for emails that seem to be coming from your account.
Get a reply to a message you never sent.
Are told by people that they’re getting spam from you, but you haven’t sent them emails.
See an email in Spam that replaces your email address with “me.”

What is spoofing

To spoof is to send emails from a fake sending email address. You make the From email look as if it’s sent by someone else.
The idea is to trick people into thinking an email is coming from someone they trust, but it’s actually sent with malicious intent, like obtaining sensitive information or hacking someone’s account.
For example, someone may know that you’re going to email your client a payment request. Then they send a fake email to your customer, pretending to be coming from you, getting your customer to send the payment their way instead.

How to prevent spoofing with Google Workspace using DMARC

You can prevent spoofing of your domain thanks to DMARC (Domain-based Message Authentication Reporting & Conformance).
DMARC allows you to choose what to do once an SPF or DKIM check has failed.
SPF/DKIM checks are automatically performed on all sent mail from your domain.
Spoofers can’t fake SPF and DKIM, so when the check fails, you’re usually dealing with spoofing.
Through DMARC, you get to say what happens to the spoofed message.
After adding a DMARC record, you periodically receive reports about messages that have passed and failed the DMARC policy checks.

Steps you must take before setting up DMARC

To use DMARC, you must already have SPF and DKIM records already added and working.
If you send emails from any non-Google mail services, you must make sure you configure your SPF and DKIM correctly to apply to such emails. Otherwise, they will be treated as illegitimate by DMARC may cause you issues.

How to set up DMARC step-by-step with images

Step 1

To set up DMARC, first, log in to your account at your DNS hosting provider. Then go to the section where you can update your records and start creating a new TXT record.

Here is a list of links to the most frequently used hosting providers’ pages that show you how to add records and contact support.

If you don’t see your hosting in the list, go to Google Search and look for “add txt record -your domain host’s name here-” (for example: add txt record siteground.com),

Then follow your domain host’s instructions on creating a TXT record. If you can’t find instructions or they’re not helpful, contact the hosting’s support team.

_________________________

The TXT Host name should be “_dmarc.yourdomain” – replace yourdomain with your domain. For example, for workspace123.com, the Host name is _dmarc.workspace123.com

Next, add the text “v=DMARC1; p=reject; rua=mailto:[email protected]”

v=DMARC1 means that this is a DMARC record.

p=reject means that any email that fails the checks will be rejected.

Alternatively, you can set p to none – this way, no action is taken, but you get notified when a message fails DMARC checks via the DMARC report. You can also set p to quarantine. This way, all affected emails will be marked as spam.

rua=mailto:[email protected] – this specifies the email address which will receive the DMARC reports. Substitute [email protected] with your actual email address.

After adding the DMARC TXT record, make sure to save it!

You can do more with DMARC, but the ideal record you aim to have at the end is the one above. You may like to start with p=none or p=quarantine at the beginning so that you don’t end up rejecting any legitimate emails.

Google has more info on DMARC records here https://support.google.com/a/answer/2466563. It may take up to 24 hours for the TXT record to start working.