Can someone spoof email from my domain?

Email's underlying protocol (SMTP) doesn't verify who sent a message by default — the "From" address is just a claim, the same way a paper letter's return address is whatever the sender wrote on it. Whether someone else can successfully send mail that looks like it's from your domain depends on three DNS-published standards: SPF, DKIM and DMARC.

Why spoofing is possible at all

SMTP was designed in an era before large-scale abuse. Nothing in the base protocol stops a sending server from writing any address it wants in the "From" header. Receiving mail servers have to decide, on their own, whether to trust that claim — and they do that by checking whether the sending server is authorised for that domain (SPF), whether the message carries a valid cryptographic signature from that domain (DKIM), and what the domain owner has told receivers to do if those checks fail (DMARC).

What actually stops it

• SPF publishes which mail servers are allowed to send for your domain.
• DKIM lets receivers verify a message wasn't altered and really came from a server holding your domain's private key.
• DMARC tells receivers what to do — and where to report — when a message fails both.

None of these are enforced unless the domain owner publishes the right DNS records, and DMARC enforcement in particular is something to move into gradually, with evidence, not on day one — see the methodology page for why.