What is email spoofing?

Email was designed in an era of trust, so the sender address on a message is just text the sender types. Spoofing exploits that. Microsoft describes spoofed messages as ones that "appear to originate from someone or somewhere other than the actual source." This guide explains the three common kinds, what SPF, DKIM and DMARC do about each, and what they leave to you.

What is email spoofing?

Every email has two sender addresses, and attackers can fake either:

• The envelope sender (also called MAIL FROM or the return path). Servers use it for bounces. Recipients rarely see it.
• The From header. This is the address your mail app shows. It usually has a display name too, like "Jane Smith" <jane@example.com>.

People judge a message by the From header, so that's what spoofers target. Microsoft's anti-spoofing technology "specifically examines forgery of the From header field," because email clients show it as the sender.

Spoofing is a technique, not an attack in itself. It's used to make phishing, invoice fraud and malware look trustworthy. Business email compromise often starts with a spoofed message from a "boss" or "supplier." For the bigger picture, read our guide on business email compromise prevention.

What are the types of email spoofing?

Display-name spoofing

The attacker sets the display name to someone you trust and uses any address they like. Many mail apps, especially on phones, show only the name. The message comes from a real, correctly configured free mailbox, so it passes every authentication check.

DMARC doesn't try to fix this. RFC 9989, section 2.4, lists "attacks in the display name portions of the RFC5322.From header field" as out of scope.

Exact-domain spoofing

The attacker puts your real domain in the From header and sends from their own server. A customer sees accounts@yourcompany.com and has no visual reason to doubt it. This is the type email authentication was built for.

A related case is self-to-self spoofing, where a message to your staff claims to come from your own domain. Microsoft calls this intra-org spoofing and flags it separately from cross-domain spoofing.

Lookalike domains

The attacker registers a domain that looks like yours: a swapped letter (rn for m), a different top-level domain, an added word like -invoices, or characters from another alphabet that look identical. Because they own the domain, they can publish valid SPF, DKIM and even DMARC records for it. Every check passes, honestly.

RFC 9989 is explicit that DMARC "does not address the use of visually similar domain names." Our guide to lookalike domain phishing covers how to watch for them.

How do SPF, DKIM and DMARC stop exact-domain spoofing?

Each record does part of the job. Only together do they protect the From address people see.

SPF checks the sending server

SPF (RFC 7208) lets you publish the servers allowed to send for your domain. But it checks the envelope sender and the HELO name, not the From header. The RFC says checking other identities against SPF records is "NOT RECOMMENDED." So an attacker can use their own domain in the envelope, pass SPF for it, and still put your domain in the From header.

DKIM checks a signature

DKIM (RFC 6376) adds a signature that proves a domain took responsibility for the message and that signed parts weren't changed. The signing domain (d=) doesn't have to match the From address. The RFC says it "does not require the value of the SDID or AUID to match an identifier in any other message header field." An attacker can sign with their own domain.

DMARC ties them to the From address

DMARC closes the gap. A message passes DMARC only if SPF or DKIM passes and the domain that passed is aligned with the domain in the From header. By default, alignment is relaxed, so mail.example.com aligns with example.com. The domain owner also publishes a policy:

• p=none: monitor only. Receivers don't act on failures because of DMARC.
• p=quarantine: treat failures as suspicious, usually by sending them to junk.
• p=reject: refuse failing messages.

Here's how an exact-domain spoof plays out against each policy:

1. An attacker sends From: billing@example.com from a server not in example.com's SPF record and without example.com's DKIM key.
2. The receiver checks SPF. Either it fails for example.com, or it passes for the attacker's envelope domain, which isn't aligned.
3. The receiver checks DKIM. There's no valid signature from example.com.
4. DMARC fails, because neither check produced an aligned pass.
5. The receiver looks up example.com's DMARC policy. At p=none, it decides using its other signals and may deliver the message. At p=quarantine or p=reject, it junks or refuses it.

That's why the FTC tells small businesses to use all three tools, and why Google's sender guidelines require DMARC from bulk senders. Publishing p=none forever gives you reports but little protection. Our guide on DMARC record examples shows what each policy looks like.

What don't SPF, DKIM and DMARC stop?

Being honest about the limits helps you cover them.

• Display-name spoofing. Out of scope, as above.
• Lookalike domains. The attacker's own records pass.
• Compromised accounts. If an attacker signs in to a real mailbox at a supplier, their mail is genuinely from that domain and passes everything.
• Receivers that don't enforce. DMARC is a request. Each receiving system decides how to apply it. Microsoft, for instance, notes that a failed check "doesn't directly result in blocking a message" and combines it with other signals.
• Your domain at p=none. Receivers get no instruction to act.
• Domains you don't send from. A parked domain with no records is easy to spoof. Publish an SPF record of v=spf1 -all and a DMARC record of p=reject for every domain that never sends mail.

So authentication protects your domain from being forged. Protecting your inbox from the other kinds of spoofing takes filtering and people.

How can you tell if an email is spoofed?

You can't always tell from the inbox view, but the headers rarely lie about authentication results. Use this check on any message that asks for money, credentials or urgency.

1. Look at the full sender address. Tap or hover over the name. A display name of your CEO with a free mailbox address behind it is the most common trick.
2. Compare the domain letter by letter. Look for swapped letters, extra words, hyphens and unusual endings such as .co instead of .com.
3. Check the Reply-To address. A spoofed message often sends replies somewhere other than the From address.
4. Open the headers. Find the Authentication-Results line. Look for spf=, dkim= and dmarc= results and note which domain each one refers to.
5. Read the result in context. dmarc=fail on a message claiming to be from a known company is a strong warning. dmarc=pass only tells you the domain is real. It doesn't tell you the domain is the one you think it is.
6. When money is involved, call. Use a phone number you already have, not one in the message.

If you find a spoof that got through, report it to your email admin so it can be removed from other mailboxes and the filter rules tightened. A message that appears to come from your own address and claims you've been hacked is a common example; see our guide to sextortion scam emails.

How do you protect your business from spoofing?

There are two jobs. First, stop people forging your domain: publish SPF, sign with DKIM and move DMARC to enforcement, then lock down domains that never send mail. Our step-by-step guide to stopping spoofing of your domain covers each record, subdomains and parked domains.

Second, stop the other kinds of spoofing reaching your inbox. Use filtering that enforces other domains' DMARC policies, require sender verification on allow-list entries (see our allow and block lists page), label external mail, and train people to verify payment requests. NIST's phishing guidance says to "verify the request by using known contact information." For a wider plan, see our email security checklist for small businesses.

Next steps

1. Run the free Email Health Check to see whether your domain has SPF, DKIM and an enforcing DMARC policy.
2. If DMARC is at p=none or missing, start the move to enforcement this month. The DMARC Record Generator builds the record for each step.
3. List the domains your business owns, and lock down any that don't send mail.
4. Share the display-name and lookalike examples above with anyone who approves payments.

Related: someone is sending email from my address walks through what to check if it's happening to you.

Browse our other phishing and threat guides.