Email spoofing is forging the sender details of an email, such as the From address or display name, so that it appears to come from someone else.
Email spoofing is the creation of email messages with a forged sender, so the recipient believes the message comes from a person or organization they trust. It is possible because the core email protocols were designed without sender verification. Spoofing is a delivery method for phishing, business email compromise and malware.
How it works
An email has two sender addresses. The envelope sender (also called MAIL FROM or Return-Path) is used by servers; the header From address is what the reader sees. The two can differ, and whoever sends the message can set both. Spoofing takes three main forms:
- Exact-domain spoofing: the real domain is forged in the From address.
- Display-name spoofing: a trusted name is shown, but the address behind it is unrelated.
- Lookalike-domain spoofing: the address uses a cousin domain that resembles the real one.
SPF, DKIM and DMARC let receiving servers check whether a message using a domain is authorized by that domain's owner. DMARC is the piece that connects those checks to the visible From address, which is why it is the main defence against exact-domain spoofing.
Example
An illustrative case: an employee receives a message from "IT Service Desk" with a From address on the company's own domain. The sending server belongs to an unrelated provider, and the message fails both SPF and DKIM. Because the company's DMARC policy is still p=none, the message is delivered anyway and asks the employee to confirm their password.
How to spot it
- The display name does not match the address, or replies go to a different address.
- Message headers show
spf=fail,dkim=failordmarc=fail. - The mail client shows a warning about an unverified sender.
- The request is unusual, even though the address looks right.
What brands can do
- Make an inventory of every service that sends email for your domains.
- Publish SPF and DKIM for each, then move DMARC to enforcement.
- Give domains that never send mail a reject policy.
- Read DMARC aggregate reports to spot abuse and forgotten senders.
Once exact spoofing is blocked, attackers move to lookalike domains. Phishvoid finds those and takes them down; contact the team for details. A full walkthrough is in SPF, DKIM and DMARC against email spoofing.
Read more: SPF, DKIM and DMARC: Stop Spoofed Email in Your Brand’s Name
Seeing this against your brand?
We find and take down phishing and impersonation sites. Tell us what you are seeing.