Described herein are techniques for preventing MAC address spoofs in a virtualization cluster. When a virtual switch first sees a new MAC address on a port designated as being a secure port, the packet is redirected to a virtual supervisor agent used to manage the distributed virtual switch. Assuming the MAC may be bound to the secure port, the supervisor agent broadcasts a message to both the virtual switch that redirected the packet and to virtual switches on other virtualization servers within the cluster.