{"id":2894,"date":"2020-04-03T21:39:42","date_gmt":"2020-04-03T19:39:42","guid":{"rendered":"https:\/\/chapmanbright.com\/?post_type=resources&p=2894"},"modified":"2025-11-17T12:53:04","modified_gmt":"2025-11-17T11:53:04","slug":"what-marketers-can-do-to-prevent-email-spoofing","status":"publish","type":"resources","link":"https:\/\/chapmanbright.com\/nl\/resources\/other\/what-marketers-can-do-to-prevent-email-spoofing\/","title":"What marketers can do to prevent email spoofing","content":{"rendered":"","protected":false},"parent":0,"template":"","cb_resources_category":[91],"class_list":["post-2894","resources","type-resources","status-publish","hentry","cb_resources_category-other"],"acf":{"banner":5729,"title":"What marketers can do to prevent email spoofing","text_overview":"RTL journalists discovered a vulnerability in Dutch official government emails on COVID-19. Unfortunately, criminals abuse the current situation. Read our advice on how to prevent these spoofing cases from a tech and marketing perspective.","image":5957,"button":"Discover","components":[{"acf_fc_layout":"layout_textblock_full","background":"grey-light","title":"","text":"This article reflects Chapman Bright\u2019s earlier focus on Marketo and 'classical' marketing automation.\r\nToday we help B2B companies scale productivity with automation, AI, and agents. Read more<\/a><\/em>","button":null},{"acf_fc_layout":"layout_text_image","title":"RTL: 'Dutch Government vulnerable to spoofing'","text":"An hour ago, Dutch national broadcaster RTL Nieuws opened with a headline<\/a> about possible fake COVID-19 update emails from the National Institute for Public Health (RIVM). Contrary to earlier cases, the received emails looked official and did not seem to come from fake email addresses. An inside job? All of a sudden, SPF and DKIM, commonly used terms in email marketing, got introduced in mainstream media. How can you as a marketing or communications professional avoid that you or your clients become a victim?\r\n
Image courtesy: RTL Nieuws<\/pre>","image":5912,"background":"none"},{"acf_fc_layout":"layout_textblock_full","background":"grey-dark","title":"","text":"
The usual spoofing case<\/h2>\r\nThis message hit my spam box today and seemed to be sent by a Dutch retailer. Besides the unnecessary underscores in the subject line, there is not much suspicious to notice.\r\n\r\n\"\"\r\n\r\nHowever, after having a look at the from-address, you\u2019ll notice immediately that this message has nothing to do with the retailer.\r\n\r\n\"\"\r\n
How to prevent common spoofing?<\/h5>\r\nYou cannot prevent criminals from using fake names, email addresses or even calling people on behalf of your company. But you can make sure your clients get used to your regular style of writing, visuals and sending frequency. That makes it easier for them to recognize any abnormalities. Below you\u2019ll find some further advice on this.","button":null},{"acf_fc_layout":"layout_textblock_full","background":"none","title":"","text":"
Today\u2019s RIVM case<\/strong><\/h2>\r\nIt\u2019s way more difficult in case your real email domain is used, which happened to be the case with the Dutch National Institute for Public Health today. It was sent from a real noreply@ address from the right domain, rivm.nl. Is it possible for people outside of my organization to send emails from my official domain? Yes, it is. In case you\u2019re using Outlook to send emails to coworkers or external contacts, Microsoft sends the email using your domain\u2019s email server, but you can use any server to send emails. In case you\u2019re using software like Mailchimp, Hubspot or Marketo to send your mass emails, these messages will be sent via their servers, not yours. To make sure the emails are recognized as authentic by your recipients\u2019 email clients such as Outlook, Gmail or Hotmail, you can \u2018sign\u2019 your email messages.","button":null},{"acf_fc_layout":"layout_textblock_2col","background":"none","title_left":"","text_left":"
SPF, DKIM, DMARC<\/h5>\r\nWithout going into the tech details, you can authorize external servers to use your domain name in outgoing emails. This makes it easier for email clients and spam filters to avoid unauthorized messages from being delivered to the reader\u2019s inbox. In a nutshell: Sender Policy Framework (SPF) and Domain Keys Identified Mail (DKIM) settings in your own domain\u2019s DNS white list servers to use your domain and sign the email along its journey to make sure it hasn\u2019t been modified and is authentic. Domain-based Message Authentication, Reporting and Conformance controls the SPF and DKIM policy to enable a final sign-off.\r\nAs explained by RTL\u2019s tech journalist Dani\u00ebl Verlaan (link<\/a>, Dutch) it was possible to use spoofing software to send mails from official government accounts, because of incorrect DNS settings.","video_left":null,"button_left":null,"title_right":"","text_right":"
How to prevent RIVM-like cases?<\/h5>\r\nImprove your email deliverability. Every email service provider or email marketing solution has instructions on how to make sure your domain settings are correct. It requires some information from your ESP as well as a configuration in your domain\u2019s DNS settings. Here\u2019s a quick overview of instructions for common marketing tools:\r\n