Spoofing: What is email and inbound domain spoofing and how do I prevent it?

What is domain spoofing?

Domain spoofing is a common type of phishing scam where an attacker uses a company’s domain to impersonate the business or its employees by attempting to imitate the sending server or sending domain. 

What does the inbound domain spoofing rule do?

This rule is designed to quarantine 'external' inbound messages that appear to come from your organization. This option will only assist you when you are using internal delivered mail. If you are using a third party mailing service or expecting to utilize a different relay or mail server in part of your expected mail flow, this option will mark any email that was not delivered internally as Spam/Quarantine due to Inbound Domain Spoofing being enabled.

How to enable 

1. Navigate to Security Settings> Email > Spam.
2. Enable Inbound domain spoofing protection.

Messages in the quarantine should now appear with a new category: Domain Spoofing

What Is Email Spoofing?

Email spoofing is the creation of email messages with a forged sender address (such as your own email address). It is easy to do because the core protocols do not have any mechanism for authentication. It can be accomplished from within a LAN (Local Area Network) or from an external environment.

Why Do People Spoof My Company's Email Addresses And Others?

Spam and phishing emails typically use such spoofing to mislead the recipient about the origin of the message. For more details and even some history regarding this type of behavior, you can refer to the link below:
https://www.proofpoint.com/us/threat-reference/email-spoofing 

How Do I Help Prevent People Spoofing Me Or My Domain?

By adding SPF (Sender Policy Framework) records to your existing DNS information, this will increase the chances that any spoofed email will be detected and is an added security measure, as all incoming emails will have the sender information validated.  Adding an SPF record will help dramatically reduce any attempted phishing or spoofed messages from being delivered as this creates a trusted path for your email communications to be verified against.