Email spoofing is the technique of forging the sender address of an email so that the message appears to come from someone it does not. It is the oldest attack in the SMTP protocol, still one of the most common, and the reason SPF, DKIM and DMARC exist. In 2026, spoofing is behind billions of dollars in Business Email Compromise (BEC) losses annually, and every organization sending mail is a potential target for spoofed impersonation.
This guide covers what email spoofing actually is (and is not), how the attack works at the protocol level, the three main patterns attackers use, how to detect a spoofed message in your inbox, and the four-layer defense that prevents your domain from being spoofed at all.
p=reject) so receivers can verify and reject forged mail. Detection means checking full headers for authentication results, not trusting the visible From name.What Email Spoofing Actually Is
Email spoofing is the practice of forging the visible sender of an email. An attacker sends a message that appears in the recipient’s inbox as if it came from someone else, usually a trusted contact, brand, executive, or vendor. The forgery targets one or more of three header fields:
- The From header (what the recipient sees), often written as
"CEO Name" <ceo@target-company.com> - The MAIL FROM envelope (used in SMTP for bounce handling), often invisible to end users
- The Reply-To header (where responses go), which can redirect a reply to the attacker’s inbox
Because the original SMTP specification (RFC 821, 1982) did not include any sender verification, any mail server can technically send a message claiming any From address. The protocol trusts the sender’s claim. This is why SPF, DKIM and DMARC were retrofitted decades later, they add verification layers on top of unauthenticated SMTP.
Spoofing vs Phishing vs Impersonation
These three terms are often used interchangeably, but they describe different attacks. Understanding the distinction matters because the defenses differ.
| Attack | What it does | Prevention |
|---|---|---|
| Spoofing | Forges the From address to look like a real sender at a real domain | SPF, DKIM, DMARC at p=reject |
| Phishing | Uses social engineering to trick recipients into revealing credentials or clicking malicious links (may or may not use spoofing) | Recipient training, link scanning, MFA |
| Display-name impersonation | Sends from an unrelated domain but uses the target’s name in the display field | Anti-impersonation filters, external banners |
| Lookalike domain | Registers a similar-looking domain (rn instead of m, .co instead of .com) and sends legitimately from it | Domain monitoring, brand-protection services |
| Business Email Compromise (BEC) | Combines any of the above with financial fraud (fake wire transfer requests) | Financial verification workflows, all of the above |
Pure spoofing is the easiest to detect and prevent technically. Display-name impersonation and lookalike domains slip past SPF/DKIM/DMARC because the attacker sends legitimately from their own infrastructure, they just present as someone else.
How Email Spoofing Works at the Protocol Level
To understand why spoofing is possible, look at what happens when an SMTP server accepts a message.
The SMTP conversation
When any mail server (yours or an attacker’s) connects to a receiving server to deliver mail, the conversation follows this pattern:
220 mx.receiver.com ESMTP Ready
HELO attacker-server.example
250 Hello attacker-server.example
MAIL FROM:<anything@iwant.com>
250 Sender OK
RCPT TO:<victim@target.com>
250 Recipient OK
DATA
354 Send data
From: “CEO” <ceo@target.com>
To: victim@target.com
Subject: Wire transfer needed
[message body]
.
250 Message accepted
Notice that the sending server declares MAIL FROM: anything@iwant.com in the envelope, and then inside the DATA the From header says ceo@target.com. The receiving server has no built-in mechanism to check whether the sending server is actually authorized to send as either address. SPF checks the envelope MAIL FROM. DKIM verifies the DATA block signature. DMARC ties them to the From header.
Why receivers accept spoofed mail without SPF/DKIM/DMARC
If the target domain has not published SPF, DKIM keys, or a DMARC policy, receivers cannot verify anything. The message arrives, appears to be from the CEO, and the recipient reacts. This is why any unauthenticated domain is a spoofing target by default.
The Three Main Spoofing Patterns
ceo@your-company.com, using your actual domain. This is what SPF, DKIM, and DMARC at p=reject stop cold, if you have them published. If you do not, exact spoofing succeeds and receivers deliver the message to the inbox.attacker@random-outlook.com) but sets the display name to CEO Name. On mobile, most mail clients show only the display name, so the recipient sees “CEO Name” and does not notice the actual sending address. This bypasses SPF/DKIM/DMARC entirely because the sending domain is not spoofed, it is just misleading.your-cornpany.com (rn instead of m), your-company.co (dropping the m), or your-cornpany.com with a Cyrillic “а”. They send legitimately from that domain. All authentication passes because it is a real domain they own. Only visual inspection catches it.Business Impact of Spoofing
Spoofing enables three main financial and reputational harms.
Spoofed vendor invoices are a variant of BEC: an attacker spoofs your supplier and sends a “new banking details” notice, redirecting payment. Because the message appears to come from a known vendor, accounts payable often processes it without additional verification.
Spoofed brand mail damages sender reputation broadly. If attackers routinely spoof your-brand.com to send phishing to your customers, receivers begin flagging all mail from your domain as suspicious. Your legitimate marketing and transactional messages get filtered as collateral damage.
Regulatory and compliance risk applies too. Under GDPR and comparable regimes, an organization can face penalties if inadequate email security enables a data breach, which spoofing often triggers.
How to Detect a Spoofed Email in Your Inbox
Any recipient can check whether a message is spoofed by examining full headers. Every mail client supports this, most just bury the option.
Authentication-Results:. It will show SPF, DKIM and DMARC results. A legitimate message shows spf=pass, dkim=pass, and dmarc=pass. Any fail, softfail, or none is a warning sign.Return-Path: header shows the SMTP envelope sender. If Return-Path says bounce@some-random-domain.com but From says ceo@your-company.com, alignment has failed. Modern legitimate senders align both.ceo1@gmail.com or something equally suspicious. Tap or expand the sender to see the real address.How to Prevent Your Domain From Being Spoofed
Preventing exact-domain spoofing is entirely on the sender’s side. If you publish and enforce the three authentication standards, exact spoofing of your domain becomes impossible at compliant receivers (which now include Gmail, Yahoo, Outlook.com, and most enterprise mail systems).
- SPF: publish a TXT record listing every server allowed to send as your domain
- DKIM: sign every outbound message with a cryptographic signature, rotate keys yearly
- DMARC: publish a policy record telling receivers to reject unaligned mail, progress from
p=nonetop=quarantinetop=reject - BIMI: publish a Brand Indicators for Message Identification record so your logo appears next to authenticated mail in supporting clients (Gmail, Yahoo, Apple Mail iOS 16+)
SPF: authorize your senders
SPF is a TXT record at your domain listing the IPs and services allowed to send mail as your domain. Any receiver that does an SPF check will validate the sending server’s IP against your record. A match passes, a mismatch fails.
DKIM: sign every message
DKIM adds a cryptographic signature to the message headers using a private key. The public key sits in your DNS. Receivers verify the signature to confirm the message was not tampered with in transit and that it was signed by a party in possession of your private key.
DMARC: enforce alignment
DMARC ties SPF and DKIM to the visible From header. It requires either the SPF-verified domain or the DKIM signing domain to align with the From. Then it tells receivers what to do when alignment fails: nothing (p=none), spam folder (p=quarantine), or reject (p=reject).
p=none monitors but does not protect. Only p=reject (or p=quarantine) actually prevents spoofed mail from reaching recipients. Publishing p=none and stopping there is a common oversight that leaves you exposed.BIMI: visual confirmation for recipients
BIMI requires DMARC at p=quarantine or higher and a Verified Mark Certificate (VMC). When set up, your logo appears next to authenticated mail in supporting clients. This gives recipients a visible cue that mail is legitimate, and its absence a cue that something is off.
Reporting a Spoofed Email You Received
If you receive a spoofed message impersonating a real company or contact, report it through multiple channels for maximum effect.
- To the impersonated organization: most large brands have a
phishing@orsecurity@address to report impersonation. Forward the full message including headers. - To your mail provider: Gmail, Outlook, and Yahoo all have a “Report phishing” option that trains their filters and blocks similar messages network-wide.
- To your organization’s IT or security team: even if the spoof did not fool you, others may have received the same wave. Fast reporting containment.
- To national reporting agencies: in the US, forward to reportfraud.ftc.gov or IC3. In the UK, Action Fraud. In the EU, your national CERT.
Frequently Asked Questions
Can email spoofing be completely prevented?
Exact-domain spoofing (mail forged to appear from your actual domain) can be prevented by publishing DMARC at p=reject. Display-name spoofing and lookalike-domain attacks cannot be prevented at the protocol level, they require anti-impersonation filtering and recipient awareness.
How do attackers know which domains to spoof?
They enumerate targets from public sources: LinkedIn (identifying finance and executive contacts), company websites, press releases, and data breaches that expose email addresses. Any organization with a public web presence is discoverable and targetable.
Does spoofing require hacking my email server?
No. Spoofing does not compromise your infrastructure at all. The attacker sends from their own server (or a compromised third-party server) and forges the From address. Your servers, users and passwords are untouched.
Is spoofing illegal?
Sending spoofed mail with intent to defraud, harass, or impersonate is illegal in most jurisdictions. In the US, it falls under the CAN-SPAM Act (for commercial spoofing) and various fraud statutes. Prosecution requires identifying the attacker, which is technically difficult when they use compromised infrastructure.
Do transactional platforms like SendGrid protect against spoofing?
They protect your sending, they do not protect your domain from being spoofed by third parties. SendGrid, Postmark, Mailgun and others authenticate mail you send through them. Preventing others from spoofing your domain requires DMARC on your side, regardless of which platform you use.
How long does it take to deploy DMARC at p=reject?
4 to 12 weeks typically. Start at p=none with aggregate reporting, monitor for 4 to 6 weeks to identify all legitimate mail streams, fix any misalignment, progress to p=quarantine for another 2 to 4 weeks, then to p=reject. Rushing skips important discovery of forgotten senders.
What if I do not have technical staff to set up SPF, DKIM, DMARC?
Managed DMARC services (Valimail, Dmarcian, EasyDMARC, Postmark’s DMARC monitor) walk you through setup, monitor reports, and identify unauthorized senders. Costs range from free (basic monitoring) to enterprise pricing. Setup is usually a few hours of guided work.
Can I see who is trying to spoof my domain?
Yes, through DMARC aggregate reports (rua). Every day, DMARC-compliant receivers send you a report listing every source that attempted to send as your domain, whether it aligned, and the result. Any source you do not recognize is either a legitimate but forgotten sender, or a spoofer.
Does BIMI actually stop spoofing?
BIMI does not stop spoofing directly, it makes legitimate mail visually distinct. The prevention comes from the required p=quarantine or p=reject DMARC policy that BIMI mandates. In practice, publishing BIMI is a strong forcing function to get DMARC into enforcement.
What is the difference between spoofing and email account compromise?
Spoofing forges the sender without accessing any account. Account compromise means the attacker gains actual login credentials and sends real mail from a real account. The prevention differs: DMARC stops spoofing, MFA and password hygiene stop compromise. Both can be part of the same BEC campaign.
Updated for the 2026 threat landscape. Business Email Compromise remains the largest category of email-based financial fraud, and DMARC at p=reject is the single most effective technical control against it.
About the Author
Alaa · LinkedIn
Email infrastructure specialist with 8+ years of hands-on experience in SMTP, deliverability, and email verification. I’ve configured and troubleshot mail systems across Postfix, Exchange, and cloud relays, managed IP reputation and warmup campaigns, and built verification pipelines processing millions of addresses. My work spans DNS authentication (SPF, DKIM, DMARC, BIMI), bounce handling, blocklist monitoring, and compliance frameworks including CAN-SPAM and GDPR. I write every article on SMTPedia to give email professionals, developers, and marketers the accurate, RFC-grounded reference they need.
About SMTPedia
SMTPedia is an independent email industry reference covering SMTP, IMAP, POP3, email deliverability, marketing platforms, DNS authentication, and email verification. Every article is researched from official provider documentation, IETF RFCs, and industry best practices. Settings and configurations are verified quarterly.
We are cited as a source by ChatGPT, Microsoft Copilot, and thousands of email professionals worldwide. Learn more about our editorial process.
