Email authentication for accountants

23 May 2026 · 13 min read

An accountancy practice is, from a fraudster's point of view, almost the perfect target. You hold the bank details of dozens or hundreds of clients. You routinely send invoices, payment requests, tax computations and remittance instructions by email. Your clients are conditioned to act on what you tell them, because you are the trusted authority on their money. And there is a predictable, high-pressure window every year, the run-up to the self-assessment and corporation-tax deadlines, when everyone is busy, everyone is rushing, and an unexpected "from your accountant" email is exactly what people are bracing for. That combination is why criminals impersonate accountants specifically, and why email authentication matters more for a practice than for almost any other small business.

This article is not a generic explainer about what DMARC is. It is about the threats an accountancy firm actually faces, where email authentication stops them, where it does not, and a concrete, deadline-aware plan to get your practice domain to enforcement without your client mail going missing in the middle of tax season. If you want the broad background first, what DMARC is and the accountants solution page cover the foundations. Here we get specific.

Why accountants are targeted, not just included

Generic "business email compromise" advice treats every firm the same. Accountants are not the same, for three reasons that change the threat model.

You sit on the payment instruction. When a client receives an invoice, they pay it. When you tell a client "HMRC has confirmed your refund, here are the details", they believe you. A criminal who can make an email look as if it came from your firm inherits that trust instantly. They do not need to break into anything; they need to put your domain in the From line and wait.

You have a fan-out of clients who trust you. A compromised retailer can defraud its own customers. A compromised, or merely spoofable, accountancy practice can be used to defraud every client on its books, because each of those clients reads accounts@yourpractice.co.uk as gospel. The blast radius of an unprotected accountant's domain is the entire client list.

Your calendar is public. Everyone knows the 31 January self-assessment deadline and the 31 July payment on account. Everyone knows companies file accounts and pay corporation tax on schedules tied to their year end. Fraud campaigns are timed to these dates because that is when a "pay this now or you will be penalised" message is most believable and least likely to be questioned.

So the question for a practice is not whether you will be impersonated, but whether, when you are, the receiving mail server can tell the forgery from the real thing. That is precisely the question email authentication answers.

The four fraud patterns a practice actually sees

It helps to separate the threats by mechanism, because email authentication defeats some of them completely, blunts others, and is irrelevant to one. Being honest about which is which is the difference between real security and a false sense of it.

1. Exact-domain spoofing of your practice

The attacker puts your genuine address in the From header, partner@yourpractice.co.uk or accounts@yourpractice.co.uk, sent from infrastructure that has nothing to do with you. The message tells a client their fees are overdue, or that "our bank details have changed, please use the account below for this quarter's payment". Nothing is misspelled. To the client it is indistinguishable from your real mail.

This is the variant email authentication was built to kill. A forged message sent from a server with no right to use your domain cannot produce a valid SPF pass aligned to your domain, nor a valid DKIM signature aligned to it. If your domain publishes a DMARC policy at enforcement, the receiving server checks that policy, sees authentication fail, and quarantines or rejects the message before your client ever sees it. Done properly, exact-domain spoofing of your practice simply stops being delivered.

2. Lookalike (cousin) domain fraud

Here the criminal registers a domain that resembles yours and sends from it: yourpractice-accounts.co.uk, your-practice.co.uk, yourpracctice.co.uk with a doubled letter, or .com instead of .co.uk. Because the From address is genuinely valid for that domain, the message can pass SPF, DKIM and DMARC for the lookalike. The authentication is real; it is just real for a domain the criminal owns.

This is the crucial limit to understand. DMARC protects the exact domain that publishes the record. It says nothing about domains that merely look similar to yours. Your enforcement policy cannot block yourpractice-accounts.co.uk, because you do not control its DNS. Lookalikes are countered by different means: registering the obvious variants yourself, monitoring for new registrations that resemble your name, and training staff and clients to check the domain character by character. Our lookalike domain checker shows which near-misses already exist for your name.

3. Display-name spoofing

The From address is some throwaway mailbox the attacker controls, often free webmail, but the display name is set to your firm or a partner's name: Yourpractice Accounts <yourpractice.billing@gmail.com>. Many mail clients, especially on phones, show only the display name. The recipient sees your firm's name and reads no further.

Authentication passes here too, but for the attacker's account, not for you. The mail genuinely comes from gmail.com and authenticates as gmail.com. Your domain never appears in the authenticated From, so your DMARC policy is irrelevant. This is pure display-name spoofing, defeated by client-side rules that flag external senders using internal display names, and by educating clients to tap the name and read the actual address.

4. Account takeover and vendor-style compromise

The worst case: a criminal has the real credentials to a mailbox in your practice, through phishing or a reused password, and sends from the actual account. Now the email is genuinely from partner@yourpractice.co.uk, passes every authentication check correctly, and there is no spoofing to detect, because there is none. The message is real; only the intent is fraudulent. This is the accountant's version of vendor email compromise, and the same attack runs in reverse when one of your clients or suppliers is the breached party.

No email-authentication control can stop this by definition, because authentication confirms the message came from the legitimate sender, and it did. The defences here are multi-factor authentication on every mailbox, alerting on suspicious inbox rules and forwarding, and an out-of-band verification step before any bank-detail change is actioned.

The honest summary: email authentication at enforcement shuts down pattern 1 outright, gives you the visibility to discover patterns 2 and 3 happening in your name, and is no substitute for process controls against pattern 4. It is the foundation, not the whole building. But without it, pattern 1, the easiest and most convincing attack, is wide open.

What "protected" actually means: the three records

Three DNS records do the work. They are quick to describe and easy to get subtly wrong, which is where practices come unstuck.

SPF lists the servers allowed to send mail for your domain. A practice rarely sends from just one place: there is your mailbox provider (Microsoft 365 or Google Workspace), plus your practice-management or tax software that emails clients, plus perhaps a separate marketing or newsletter tool, plus a portal that sends document-ready notifications. Every one of those needs to be in SPF, or its mail fails authentication. A minimal record looks like this:

v=spf1 include:spf.protection.outlook.com include:_spf.google.com ~all

The trap is the ten-DNS-lookup limit: each include can pull in further lookups, and practices with several senders blow past ten without realising, producing an SPF PermError that silently breaks authentication. Check yours with the SPF checker, and if you are over the limit, flattening is the fix.

DKIM adds a cryptographic signature to each message, tied to a key published in your DNS under a named selector. Each sending service has its own selector and its own key, and each must be enabled at the service and published in your DNS. Miss one and that service's mail is unsigned. Verify each with the DKIM checker.

DMARC ties the two together. It tells receivers what to do when a message claiming your domain fails both SPF and DKIM alignment, and asks them to send you reports. A starting record:

v=DMARC1; p=none; rua=mailto:dmarc@yourpractice.co.uk; fo=1

p=none means "watch but do not block". It protects nobody on its own; it is purely a listening stage, and resting there permanently is a common and dangerous mistake we cover in why p=none is false security. The protection only switches on when you move to p=quarantine and then p=reject. Confirm what you currently publish with the DMARC checker and generate a correct record with the DMARC generator.

Alignment: the part that catches accountants out

A subtlety bites practices specifically. DMARC does not just need SPF or DKIM to pass; it needs them to align with the domain in your visible From address. A great deal of accountancy mail is sent on your behalf by third-party software: the tax-return tool that emails the client a copy, the portal that sends "your documents are ready", the bookkeeping platform that mails statements. By default many of these send with their own domain in the technical envelope, so SPF authenticates their domain, not yours, and the check does not align.

The fix is to configure each of those services properly: set up a custom sending domain or subdomain so that DKIM signs as your domain, and the Return-Path aligns. Until that is done, perfectly legitimate mail from your own software fails DMARC, and if you have already moved to enforcement, that mail gets quarantined. This is the single most common cause of "we turned on DMARC and our client emails stopped arriving". The cure is not to retreat from enforcement; it is to find every sender first. Our products overview and the alignment step guide walk through exactly this for a multi-sender setup.

The enforcement plan for a practice, around your deadlines

The goal is p=reject, the policy at which a forged "from your accountant" email is actually blocked at the recipient's server. The risk is breaking real client mail on the way there. The reconciliation of those two is sequencing and timing. Here is the plan, deliberately tied to the accountancy calendar.

Step 1: audit every sender (do this in a quiet month)

Before you change a single policy, you need the complete list of services that legitimately send as you. Most practices underestimate this badly; they remember Microsoft 365 and forget the tax software, the e-signature tool, the CRM and the appointment reminders. Run an audit and a domain analysis to map what is sending now. Crucially, do this well away from a filing deadline, ideally in the late spring or summer lull, so you have room to fix alignment without pressure.

Step 2: publish p=none and read the reports

Publish p=none with a reporting address, then collect a few weeks of aggregate reports. These are XML and unfriendly to read raw; the DMARC report analyzer turns them into a plain list of who is sending as you, from where, and whether they pass. You are looking for two things: legitimate senders that are failing alignment (fix those), and unexpected sources (investigate those, as they may be spoofing already in progress). Reading these properly is covered in reading your first DMARC report.

Step 3: fix alignment on every legitimate sender

Work through the list. Add each service to SPF (watching the ten-lookup limit), enable DKIM with the correct selector at each service and publish the key, and set custom sending domains where a service defaults to its own. Re-check with the SPF and DKIM tools until every genuine sender passes and aligns. This is the heavy lifting, and it is why step 1's timing matters.

Step 4: move to p=quarantine, then p=reject

Once the reports show your legitimate mail passing cleanly, step the policy up. Go to p=quarantine first, optionally using the pct tag to ramp gradually, and keep watching reports. When quarantine is stable with no legitimate mail caught, move to p=reject. The full sequence and the safety checks at each gate are in reaching p=reject without breaking email and the enforce step guide. A practice that has done steps 1 to 3 honestly can usually complete this without a single missed client email.

Step 5: protect subdomains and the parking domain

Do not forget the domains you do not send from. If your practice owns mail.yourpractice.co.uk or a separate marketing domain, or an old domain you no longer use, each needs its own DMARC stance, because attackers love an unprotected subdomain. Use the subdomain policy (sp=) tag to set the rule for subdomains, and publish a hard reject policy on any domain that should never send mail at all. See subdomain DMARC records for the detail.

The deadline rule of thumb

Do not start an enforcement change in January or July. If you arrive at the busy season already at p=reject with clean reports, you are in the strongest possible position: forgeries are blocked exactly when fraud peaks, and your real mail is unaffected. If you have not started yet and a deadline is close, get to p=none for visibility now, but defer the move to quarantine and reject until the rush is over and you can watch the reports without distraction. Changing policy under deadline pressure is how mistakes and missed mail happen.

What this buys your clients, and your professional standing

There is a client-trust dimension that goes beyond stopping a single fraudulent payment. When your domain is at p=reject, you can tell clients, truthfully, that a genuine email from your firm will always authenticate and that anything purporting to be from you that does not should be treated as suspect. That is a concrete, checkable promise, not a vague reassurance.

It also affects whether your real mail arrives at all. Major mailbox providers now require authentication for bulk senders and increasingly favour authenticated mail generally, a shift covered in the Gmail, Yahoo and Microsoft requirements. A practice that sends statement runs or fee reminders to a large client base benefits directly: properly authenticated mail lands in the inbox, and unauthenticated mail risks the spam folder. Authentication is now a deliverability issue as much as a security one. You can sense-check your overall posture with the deliverability score tool.

For the visible trust signal, once you are at enforcement you can add BIMI, which displays your verified logo beside your messages in supporting clients. For an accountancy brand whose clients are wary of impersonation, a recognised logo on every genuine email is a small but real reassurance. BIMI requires p=quarantine or p=reject first, which is another reason enforcement is the foundation everything else sits on. Check eligibility with the BIMI checker.

The controls authentication cannot provide

Be clear-eyed about the gap. Email authentication shuts down exact-domain spoofing, surfaces lookalike and display-name abuse in your reports, and improves deliverability. It does nothing about a genuine account takeover or a real but fraudulent change-of-bank-details request. Those need process, and for a practice the process controls are not optional:

• Verify every bank-detail change out of band. Any email, however genuine it looks, that asks to change the account a payment goes to must be confirmed by a phone call to a known number, never a number in the email. Make this a written policy that applies to client instructions to you, and to your instructions to clients.
• Multi-factor authentication on every mailbox, especially partner and accounts@ addresses. Most account takeovers begin with a phished password that MFA would have stopped.
• Monitor for malicious inbox rules and forwarding. Attackers who get into a mailbox set rules to hide their tracks. Alerting on new auto-forwarding to external addresses catches a compromise early.
• Tell your clients what genuine looks like. A short note stating your exact sending domain, that your bank details do not change by email, and that they should verify any payment change by phone, costs nothing and pre-empts the most common fraud.
• Register and monitor lookalikes. Buy the obvious variants of your domain, and watch for new registrations resembling your name using the lookalike domain checker.

The practical takeaway

For an accountancy practice, email authentication is the single highest-value security control you can put in place, because exact-domain spoofing is the easiest, most convincing attack against you and authentication at enforcement stops it cold. But it only protects once you reach p=reject, it only stays safe if you find every legitimate sender first, and it must be paired with out-of-band verification for the account-takeover case it cannot touch. The sequencing matters as much as the records: audit and fix in a quiet month, reach enforcement before the filing rush, and never change policy under deadline pressure.

Start by seeing where you stand today. Run your domain through the DMARC checker, SPF checker and DKIM checker, read the results against the requirements, and turn on continuous monitoring so a future misconfiguration cannot quietly reopen you. If you would rather not run the enforcement journey yourself during a busy filing season, our done-for-you service for accountants takes your practice domain from p=none to p=reject on a monitored schedule, finds every sender first, and keeps you there, so the only people who cannot send as your firm are the criminals trying to.