How to Protect Yourself from Domain Spoofing and Phishing with ExchangeDefender | ExchangeDefender [ Skip to content ](#main) [ ![ExchangeDefender](/assets/images/xd_logo_blue.png) ](/) Email Security ![Platform Overview](/assets/images/m-xd-pro.png)### ExchangeDefender PRO Enterprise-grade email security made simple for every business. [Sign Up](/sign-up) [Live Demo](/demo) [Email Security Stops spam, malware & phishing in real time. ](/email-security) [Encryption Secure your emails, attachments & sensitive data. ](/corporate-email-encryption) [Web File Sharing Easy, safe cloud file sharing with access control. ](/web-file-server) [Live Archive Locked-in email backup & continuity during outages. ](/livearchive-backup) [Emergency Inbox Keep email flowing without interruption if your provider fails. ](/inbox) [Spearphish Train your team with phishing simulations & risk tracking. ](/spearphishing) Managed Email ### Enterprise-Grade Managed Email Reliable, secure, and fully managed email operations for modern organizations. ![ExchangeDefender](/assets/images/managed_email_menu.png) [Microsoft365/Google Email Management Expert management and security for Microsoft 365 and Google Workspace email. ](/managed-email-operations) [AI Advisory Secure, practical AI consulting & implementation for SMBs. ](/management-ai) Company ### ExchangeDefender: 29+ Years of Trust We are a cybersecurity company focused on business email protection, with 29+ years of experience keeping organizations secure, connected, and resilient. ![ExchangeDefender](/assets/images/careers_1.png) [ About Us Learn our purpose, values, and the mission behind every decision. ](/about-us) [ Blog News, product updates and email security insights. ](/blog) [ Capabilities Discover the tech and expertise that keep your email secure around the clock ](/capabilities) [ Careers Be part of a team using modern tech to solve real threats and ship great work. ](/careers) [Partners](/partners) [Docs](/docs) [Contact Us](/contact) Talk to a Human Open menu Menu ---- Email Security [Email Security](/email-security) [Encryption](/corporate-email-encryption) [Web File Sharing](/web-file-server) [Live Archive](/livearchive-backup) [Inbox](/inbox) [Spearphish](/spearphishing) Managed Email [Microsoft365/Google Email Management](/managed-email-operations) [AI Advisory](/management-ai) Company [About Us](/about-us) [Blog](/blog) [Capabilities](/capabilities) [Careers](/careers) [Partners](/partners) [Docs](/docs) [Contact Us](/contact) Talk to a Human November 8, 2019 · [General](https://www-preview.exchangedefender.com/blog?category=uncategorized) How to Protect Yourself from Domain Spoofing and Phishing with ExchangeDefender =============================================================================== ![](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2019/11/Screen-Shot-2019-11-08-at-2.32.32-PM-1024x658.png) At ExchangeDefender we want you to be safe online. One of the biggest and best steps you can take towards that goal is to both protect your domain from being “spoofed” (forged by a spammer) and to block any such forgeries from arriving into your mailbox. #### About Spoofing Spammers and hackers routinely abuse domains that do not have a SPF or DKIM record. They configure their email software to use *your domain name* for a SPAM campaign or to launch sophisticated phishing attacks. If you’ve ever received an email from yourself, or from a forged government or corporate entity, you’ve been a victim of spoofing. If you’ve ever received thousands of rejections and delivery receipts for messages you never sent, you’ve been a victim of spoofing. Because so many domain owners do not take responsibility for their DNS configuration, this is the most widely abused mechanism. **Good news is, ExchangeDefender can help protect you from these attacks and brand misuse through implementation of SPF, DKIM, and our corporate policies.** #### SPF (Sender Policy Framework) ExchangeDefender uses SPF to verify that the email is coming from a source that your organization trusts to send messages. This is typically your email server, our email server, and sometimes a business application (like a hosted CRM) that sends email using your domain name. All others get rejected as forgeries. How do you setup your SPF record? Simply go to wherever your domain name is hosted (your name server) and add this TXT field to your zone. You may need assistance from your ISP, domain registrar, or whoever is actually running your name servers. If you don’t know who that is, or they are too difficult to use, ExchangeDefender will host your domain free of charge. The TXT record will not have a hostname and the value should be set to the following: **Hostname:** **Record type: TXT** **Value: v=spf1 include:proxy.exchangedefender.com -all** #### DKIM (Domain Keys) ExchangeDefender uses DKIM to validate automated digital signatures. We also sign messages for all customers that rely on ExchangeDefender to send outbound mail (pretty much everyone). This is a 2 step process similar to SPF. **Step 1: Request public key** Go to [https://support.ownwebnow.com](https://support.ownwebnow.com) and open a ticket requesting signatures of your outbound mail. Please specify which domains you wish to sign because each domain must have its own set of keys. **Step 2: Create a DKIM public record** Go to wherever your DNS is hosted and just like in SPF, create a DKIM record: **Hostname: default.\_domainkey** **Record type: TXT** **Value: v=DKIM1; k=rsa; s=email; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC0SXzBGHoJcBVKyNEntvTiMtoSIH4uiuY6i5hzF47****A2eYb4pB/gtsHpP1vpDgzZvwVLz65nQwnm4wvSFsarKwCyWYyvGwPvBd9+v2Jcrk5dsfHioUDZo5oSvbRY****+e8AD7eo42A/pYdgZxL9KRyZbMsCtHJrAqvYB6LZP0SFVvkYQIDAQAB** --- *Important*: This is just an example. You will need to use your own public key generated in Step 1 and provided by us. Also, the value of the TXT record has to be on the same line, if there are any line breaks (if you copy it from an email or web page) please remove them. --- **Step 3: Update the ticket with us to test deployment** After the DNS record has been created for your domain, we will validate it and if configuration is valid we will start signing your outbound messages going through ExchangeDefender. After the DNS record has been created for your domain, we will validate it and if configuration is valid we will start signing your outbound messages going through ExchangeDefender. #### ExchangeDefender Policy While we encourage all of our clients to implement both SPF and DKIM, we understand that there are sometimes business scenario cases under which this is impossible. If you find yourself in this predicament you should immediately change where your name servers are hosted and take full control of your organizations identity online. But if that is still something you may not be able to do, ExchangeDefender can still protect you from phishing attacks and spoofing launched using your own domain name. If you’ve ever received email from yourself or from a colleague (but the email actually came from a server in Poland) then this setting will help you. **Go to** [**https://admin.exchangedefender.com**](https://admin.exchangedefender.com) **and login as the domain administrator (username is your domain name).** [![](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2019/11/TurnOff-Phishing-Protection-1024x629.png)](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2019/11/TurnOff-Phishing-Protection.png) Click on **Security Settings** > Phishing Under “*Flag External Emails*” click on **Enable** and then **Save**. After this setting is applied, all messages from your domain that were sent from outside of the ExchangeDefender network will go into the SureSPAM quarantine. Just tell users not to trust, whitelist, or release messages that are coming from your own domain because they are certainly not legitimate.Note: This is the option of last resort and will not stop hackers or spammers from abusing your domain for phishing, spamming, or hacking. However, it will stop those messages from arriving directly into your users mailbox. If you already have a valid SPF record (with -all, not ~all) and DKIM in production, this setting is not necessary as ExchangeDefender will automatically reject messages that fail SPF/DKIM validation. If you have any questions or concerns about ExchangeDefender and implementation of SPF, DKIM, or phishing policies please feel free to contact us. [ Previous post ExchangeDefender vs. Hacked Exim/cPanel servers November 4, 2019 ](https://www-preview.exchangedefender.com/blog/2019/11/exchangedefender-vs-hacked-exim-cpanel-servers) [ Next post ExchangeDefender Phases Out "Essentials & Exchange Hosting Essentials" Services November 13, 2019 ](https://www-preview.exchangedefender.com/blog/2019/11/exchangedefender-phases-out-essentials-exchange-hosting-essentials-services) Related Posts ------------- [ 1 May ](https://www-preview.exchangedefender.com/blog/2026/05/exchangedefender-new-ui-is-live)### [ExchangeDefender New UI is Live](https://www-preview.exchangedefender.com/blog/2026/05/exchangedefender-new-ui-is-live) [Read more: ExchangeDefender New UI is Live](https://www-preview.exchangedefender.com/blog/2026/05/exchangedefender-new-ui-is-live) [ ![](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2025/12/christmas-1.jpg) 25 Dec ](https://www-preview.exchangedefender.com/blog/2025/12/merry-christmas)### [Merry Christmas](https://www-preview.exchangedefender.com/blog/2025/12/merry-christmas) [Read more: Merry Christmas](https://www-preview.exchangedefender.com/blog/2025/12/merry-christmas) [ ![](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2025/11/Website-Screenshots-2025-4.jpg) 4 Nov ](https://www-preview.exchangedefender.com/blog/2025/11/why-iot-devices-are-a-hidden-security-risk-for-your-business)### [Why IoT Devices Are a Hidden Security Risk for Your Business](https://www-preview.exchangedefender.com/blog/2025/11/why-iot-devices-are-a-hidden-security-risk-for-your-business) [Read more: Why IoT Devices Are a Hidden Security Risk for Your Business](https://www-preview.exchangedefender.com/blog/2025/11/why-iot-devices-are-a-hidden-security-risk-for-your-business) Search the blog Search Recent Posts ------------ - [ExchangeDefender New UI is Live](https://www-preview.exchangedefender.com/blog/2026/05/exchangedefender-new-ui-is-live) - [Announcing ExchangeDefender 10](https://www-preview.exchangedefender.com/blog/2026/04/announcing-exchangedefender-10) - [Merry Christmas](https://www-preview.exchangedefender.com/blog/2025/12/merry-christmas) - [Why IoT Devices Are a Hidden Security Risk for Your Business](https://www-preview.exchangedefender.com/blog/2025/11/why-iot-devices-are-a-hidden-security-risk-for-your-business) - [Top 5 IT Problems Small Businesses Face in 2025 — and How to Fix Them](https://www-preview.exchangedefender.com/blog/2025/10/top-5-it-problems-small-businesses-face-in-2025-and-how-to-fix-them) Categories ---------- - [Archiving](https://www-preview.exchangedefender.com/blog?category=archiving) (21) - [Business Continuity](https://www-preview.exchangedefender.com/blog?category=business-continuity) (13) - [Compliance](https://www-preview.exchangedefender.com/blog?category=compliance) (8) - [ExchangeDefender](https://www-preview.exchangedefender.com/blog?category=exchangedefender) (349) - [General](https://www-preview.exchangedefender.com/blog?category=uncategorized) (590) - [Hosted Services](https://www-preview.exchangedefender.com/blog?category=hosted-services) (86) - [Industry News](https://www-preview.exchangedefender.com/blog?category=industrynews) (29) - [Marketing](https://www-preview.exchangedefender.com/blog?category=marketing) (18) - [Phishing](https://www-preview.exchangedefender.com/blog?category=phishing) (5) - [PRO TIPS](https://www-preview.exchangedefender.com/blog?category=pro-tips) (44) - [Product Features](https://www-preview.exchangedefender.com/blog?category=product-features) (54) - [Security](https://www-preview.exchangedefender.com/blog?category=security) (65) - [Shockey Monkey](https://www-preview.exchangedefender.com/blog?category=shockey-monkey) (22) - [Spamfilter](https://www-preview.exchangedefender.com/blog?category=spamfilter) (5) - [Support](https://www-preview.exchangedefender.com/blog?category=support) (45) - [Webinars](https://www-preview.exchangedefender.com/blog?category=webinars) (44) Solutions --------- - [Stop Spam & Malware](/email-security) - [Hands-Free Email Backup](/livearchive-backup) - [Instant Email Recovery](/inbox) - [Send Private Emails](/corporate-email-encryption) - [Train Against Email Threats](/spearphishing) - [Share Files Safely](/web-file-server) Company ------- - [About ExchangeDefender](/about-us) - [Compliance & Legal](/our-compliance) - [Become a Partner](/partners) - [Support Portal Login](https://support.exchangedefender.com/) - [Microsoft 365 Email Management](/managed-email-operations) - [AI Advisory Service](/management-ai) ![ExchangeDefender](/assets/images/dark-xd-logo.png)USA: +1 (407) 465-6800 United Kingdom: 0800 8620149 Australia: +61 0390010641 Fax: +1 (954) 839-8737 [ ](https://www.facebook.com/ExchangeDefender) [ ](https://www.twitter.com/XD_Defender) [ ](https://www.linkedin.com/company/exchangdefender) [ ](/blog) © 2026 Own Web Now Corp - All rights reserved </> with ❤️ in Orlando [SLA](/sla) [TOS](/tos) [PRIVACY](/privacy-end-users) [AUP](/aup) We're Here to Help 👋 -------------------- Tired of AI 🤖 and hold music? Request a call or text (sms/telco charges may apply) and someone with a brain and a pulse will get in touch with you promptly. Close modal Website Name Email Address Company Phone Preferred Contact Method Text me Call me Call Date Call Time Time Zone Eastern Central Mountain Pacific London Paris Madrid Berlin Tokyo Dubai Sydney Request Human Contact Submitting... Close Start Your Free Year -------------------- Enter your details and we will set up your free year of email protection. Close modal Website Full Name Email Continue Submitting... Close Try ExchangeDefender for Free 💰 ------------------------------- We look forward to helping you secure your email. We offer a free 30-day no-risk trial, just fill out the form below and one of our onboarding techs will get you started. If you'd just like to take a look at the demo, click here for a [live demo site](/demo). Close modal Website Name Email Address Company Phone Preferred Contact Method Text me Call me Call Date Call Time Time Zone Eastern Central Mountain Pacific London Paris Madrid Berlin Tokyo Dubai Sydney 💰 Get your free month Submitting... 🏃 Explore a Live Demo Submitting... Close Train Your Team Before the Hackers Do 👋 --------------------------------------- ExchangeDefender Spearphish is our new phishing simulation and training tool, designed to help your team spot scams before they click. Want to be first in line? Request early access or get a personal demo — just drop your name and email below. Close modal Website Name Email Address Company Phone Preferred Contact Method Text me Call me Call Date Call Time Time Zone Eastern Central Mountain Pacific London Paris Madrid Berlin Tokyo Dubai Sydney Request Early Access Submitting... Close