Kirk Rice Blog

Protecting your brand: How to prevent email impersonation and domain spoofingWritten on September 24, 2026 by Kirk Rice LLP

Key points

• Cyber security includes protecting your organisation’s identity and the trust people place in its communications.
• Attackers can impersonate a business without breaching its systems, potentially putting customers, suppliers, and employees at risk.
• Knowing which services send email using your domain helps you identify activity that should not be there.
• Measures that reduce impersonation can protect people before they have to decide whether an email is genuine.
• Domain protection is one layer; attackers may also impersonate suppliers or colleagues, or use compromised accounts.

October is Cyber Security Awareness Month. To mark it, we’ve partnered with Vnetrix on a four-part series exploring cyber security risks that businesses may face and practical ways to reduce them. We begin with something easy to overlook: how attackers can misuse your organisation’s identity without gaining access to its systems. 

When cyber security is discussed, the conversation usually starts with systems, devices and data. But there is another part of the organisation that needs protecting too: its identity.

Every business relies on trust. Customers trust the emails they receive from you. Suppliers trust the people they deal with. Employees trust messages that appear to have come from colleagues. Attackers understand that too. And they do not necessarily need to compromise your network to cause damage. Sometimes it is enough to convincingly pretend to be you.

Email impersonation remains effective

Email impersonation and domain spoofing are not new problems.

They remain effective because they take advantage of something completely normal: people recognising and trusting a familiar organisation.

An email appears to come from a company someone already deals with. The branding looks right. The domain looks convincing. The request seems reasonable.

That might lead to a payment being redirected, credentials being entered into a fake login page or sensitive information being shared.

The organisation itself may never have been breached.

But from the point of view of the customer or employee receiving the message, that distinction may not matter very much.

Their trust in the organisation has still been used against them.

Visibility is often the first challenge

The practical issue for many organisations is knowing exactly what is happening with their email domain.

Businesses now have far more systems sending email than they did a few years ago.

Marketing platforms, CRM systems, finance applications, HR tools and cloud services may all legitimately send email on the organisation’s behalf.

So a useful starting point is relatively simple.

Do you know every service sending email using your domain?

Can you distinguish legitimate activity from something that should not be there?

And can somebody outside your organisation successfully send an email pretending to be you?

These sound like straightforward questions, but getting complete visibility can be harder than expected.

The aim is not to make everyone a security expert

Security awareness will always be important. But there is a limit to how much responsibility should sit with the person receiving the email. People are busy doing their jobs.

Customers should not need to inspect message headers before trusting an email from a business they know. Employees should not have to become cyber security analysts every time something lands in their inbox.

Where technology can remove an opportunity for impersonation before a person has to make that decision, that is usually a better outcome. The technology matters, but it comes second to understanding the risk.

The first question should be: where could somebody misuse our identity, and how do we reduce that opportunity?

Brand protection is only the first layer

Preventing someone from spoofing your domain does not stop every form of social engineering. An attacker could impersonate a supplier. They could compromise a genuine account. Or they could pretend to be a senior colleague using infrastructure you do not own.

This is where the different areas of cyber security start to connect. The first layer is protecting the organisation’s identity. The next is understanding how attackers target the people behind it.

Next in the series: Protecting your people, and why business email compromise is becoming harder to identify.

We would like to thank Robert Norman from Vnetrix for providing this insightful, informative article. To learn more about cybersecurity and how you can mitigate risks in your business, please visit Vnetrix or email robert.norman@vnetrix.com .