Stop Phishing and Fake Invoice Emails Targeting Your Domain

Businesses increasingly receive emails that appear to come from customers, suppliers, employees, or management.

Some of these messages are designed to steal passwords, redirect payments, or convince employees to open malicious attachments.

Fake invoice emails are especially dangerous for businesses.

What Is Phishing?

Phishing is an attempt to trick a person into revealing information or performing an unsafe action.

A phishing email may try to obtain:

• Passwords
• Banking information
• Business documents
• Account access
• Customer information

What Is Domain Spoofing?

Attackers may attempt to make an email appear as if it came from your domain.

The visible sender name may look legitimate even when the message was not actually sent by your business.

This is why email authentication is important.

Configure SPF

SPF identifies which mail servers are authorized to send email for your domain.

Create an SPF record based on your actual email-sending services.

Do not add random servers simply because a website suggests doing so.

Configure DKIM

DKIM adds a digital signature to outgoing messages.

Receiving mail systems can use the signature to verify that the message was sent through an authorized system and was not modified unexpectedly.

Configure DMARC

DMARC builds on SPF and DKIM.

It allows domain owners to specify how receiving systems should handle messages that fail authentication checks.

It also provides reporting capabilities.

Start DMARC Carefully

Businesses that have never used DMARC should understand their legitimate email sources before enforcing a strict policy.

A domain may send email from:

• Hosting mail servers
• Website forms
• Transactional applications
• Business software
• Other authorized systems

If these sources are not configured correctly, legitimate messages can fail authentication.

Train Employees

Technical controls are important, but employees also need awareness.

Teach staff to be cautious with:

• Unexpected invoices
• Urgent payment requests
• Password reset messages
• Unexpected attachments
• Unusual links

Verify Payment Changes

If an email asks you to change bank details or payment information, verify the request using a trusted communication method.

Do not rely only on the email that requested the change.

Check the Sender Carefully

Look at the actual sender address, not only the display name.

Attackers may use names such as:

"Accounts Department"

while the underlying address belongs to a completely different domain.

Be Careful With Attachments

Unexpected invoice files should be treated carefully.

Do not open attachments simply because they look like normal business documents.

Use Separate Administrative Accounts

Employees who manage important systems should not use the same account for every purpose.

Separating administrative access can reduce the impact of a compromised account.

Protect Email Passwords

Use unique, strong passwords for mailboxes.

Enable MFA where supported.

Never send passwords through normal email.

Monitor Authentication Reports

DMARC reports can help domain owners understand where email claiming to use their domain is coming from.

Review reports periodically.

Protect Your Website Forms

If your website sends emails, make sure forms are configured correctly.

Poorly configured forms can be abused for spam or malicious message delivery.

Final Thoughts

Phishing cannot be solved by one DNS record.

A strong approach combines:

• SPF
• DKIM
• DMARC
• Strong passwords
• MFA
• Employee awareness
• Payment verification
• Email monitoring

THE HOSTGURU email hosting customers should treat domain email security as an ongoing process.

Frequently Asked Questions