Email domain spoofing is one of the simplest attacks available to cybercriminals — and one of the most consistently underdefended vulnerabilities at home health agencies. Without DMARC, DKIM, and SPF configured on your email domain, any technically competent attacker can send an email that appears to come from your agency's email domain. Not a lookalike domain that differs by a character — your actual domain, delivering email to your patients, your referral hospital discharge planners, your billing company, and your own staff. The email appears to be from your executive director, your billing manager, or your care coordinator. The content can be anything the attacker wants it to be.
I have worked with home health agencies where physicians' offices received fraudulent payment requests appearing to come from the agency's billing department. Where patients received fake appointment confirmation emails appearing to come from the agency's scheduling coordinator, directing them to call a fraudulent phone number. Where hospital discharge planners received impersonated referral acceptance emails that were actually social engineering attempts to harvest credentials. Every one of these attacks was possible because the agency had not configured the three email authentication standards that together make domain spoofing technically impossible.
How Email Domain Spoofing Works Without These Controls
Email was designed in an era when identity verification was not a design consideration. The Simple Mail Transfer Protocol that underlies all email transmission allows the sender to specify any "From" address in an email regardless of which mail server actually sent the message. Without authentication controls, there is no mechanism for the receiving mail server to verify that the email claiming to be from "[email protected]" was actually sent by a mail server authorised to send email from "youragency.com." SPF, DKIM, and DMARC provide that verification mechanism — together, they create a cryptographic chain of authentication that allows receiving mail servers to confirm that an email claiming to be from your domain was actually sent by an authorised source.
SPF: Defining Who Is Authorised to Send From Your Domain
Sender Policy Framework is a DNS record — a text entry in your domain's DNS settings — that lists the IP addresses and mail servers authorised to send email from your domain. When a receiving mail server receives an email claiming to be from your domain, it checks your SPF record to determine whether the sending server is on the authorised list. If it is not, the email fails SPF authentication. An SPF record for a typical home health agency using Microsoft 365 looks like: "v=spf1 include:spf.protection.outlook.com -all" — this tells receiving servers that only Microsoft's mail servers are authorised to send email from your domain, and all other senders should be rejected.