Domain spoofing is pretending to be a legitimate domain, either by forging it in email headers or by using a lookalike domain for websites and mail.
Domain spoofing is a broad term for attacks that make a message or website appear to come from a trusted domain. In email, it usually means forging the exact domain in the From address. On the web, it means using a lookalike domain, a misleading subdomain or a deceptive link so that a fake site seems to belong to the brand. Both rely on people trusting the name they see.
How it works
Exact-domain spoofing in email works because SMTP, the protocol that moves mail between servers, does not verify the sender's address by itself. If the domain owner has not published SPF, DKIM and an enforced DMARC policy, receiving servers may accept a forged message. Once DMARC is enforced, attackers usually switch to cousin domains or to display-name tricks, where the visible name says "Example Bank Support" but the address is unrelated. On the web, spoofing relies on lookalike domains, subdomains such as examplebank.verify-account[.]net, or link text that differs from the real destination.
Example
An illustrative case: a fictional insurer has no DMARC policy. Attackers send emails with a From address on the insurer's real domain, and many reach inboxes. After the insurer enforces DMARC, the same group switches to exampleinsure-claims[.]com, which needs a different response: monitoring and takedown rather than email authentication.
How to spot it
- Message headers show SPF, DKIM or DMARC failures.
- The display name and the actual sender address do not match.
- Hovering over a link shows a destination that differs from the link text.
- The domain only resembles the official one when you read it closely.
What brands can do
- Publish SPF and DKIM for every service that sends mail for you, then move DMARC from
p=nonetop=quarantineandp=reject, guided by the reports. - Protect domains that never send mail with
v=spf1 -alland a DMARC reject policy. - Monitor and take down lookalike domains, which email authentication cannot cover.
- Consider BIMI once you reach enforcement, so your logo appears on authenticated mail.
Phishvoid covers the part DMARC cannot: it finds and takes down lookalike domains used to spoof your brand; contact the team for more. A full guide is in SPF, DKIM and DMARC against email spoofing.
Read more: SPF, DKIM and DMARC: Stop Spoofed Email in Your Brand’s Name
Seeing this against your brand?
We find and take down phishing and impersonation sites. Tell us what you are seeing.