"Spoofing" gets used for three situations that look alike from the outside and have different fixes. Start by working out which one you have.
Your own mail is flagged as spoofed
Recipients tell you their mail client warns about your messages, or the messages land in spam with a note that the sender could not be verified. Nobody is forging anything. Your real mail fails authentication. Neither SPF nor DKIM passed for a domain aligned with your From address, usually because the mail went out through a service that is not in your SPF record and does not sign with DKIM under your domain, and to the receiver that looks exactly like a forgery would.
The fix is on your side and it is complete: make every service that sends as the domain pass SPF or DKIM for the From domain itself. The pages on DMARC fail and Gmail's "Be careful with this message" go through how to find the service that is failing.
Strangers send mail as your domain
This is the case DMARC was written for. Somebody puts your domain in the From line of their mail, and you find out through bounces for messages you never sent, phishing that customers forward with your address on it, or DMARC reports listing servers you do not recognise.
You cannot stop them from sending. You can tell every receiver what to do with it, and that is what a DMARC policy is for:
- Publish DMARC with
p=noneand aruaaddress if you have not, and read the reports for a few weeks. Your own forgotten senders turn up in them next to the forgers. - Get every legitimate source passing.
- Move to
p=quarantine, thenp=reject. From then on, receivers that honour DMARC refuse or junk the forged mail. At Gmail the forger gets the 550 5.7.26 refusal.
p=none alone stops nothing; it is the stage for finding out who sends as you. The page on DMARC policy not enabled covers the record itself, and the sp= and np= tags that protect subdomains, including ones that do not exist.
Two kinds of forgery are out of DMARC's reach. A display name with your company in it and a different address behind it, "Example Support" <help@example-help.net>, passes everything, because the domain really is theirs. So does a lookalike domain registered for the purpose. Those are reported to the provider the mail came from, or to the registrar of the lookalike.
Mail that appears to come from yourself
A message in your inbox that shows your own address as the sender, often claiming your account was hacked. Usually it was not. The From line was forged, and your mailbox provider delivered it because your domain does not tell receivers to refuse such mail. With p=reject in place, most of these stop arriving at providers that check DMARC.
Checking where you stand
The DMARC checker shows the policy receivers will apply to mail that fails. Before tightening it, send real mail from each service through the full test and see whether its DMARC result passes. One warning there deserves attention at this stage: "Envelope sender is not aligned with From" while DKIM still passes. That message passes DMARC today on DKIM alone, and under p=reject it is refused the first time something breaks the signature on the way, a disclaimer your own gateway appends after signing, for instance.