# What is email spoofing? URL: https://iblockspam.com/blog/what-is-email-spoofing Last updated: 2026-10-09 Published: 2026-10-09 Topic: Phishing & threats Author: iBlockSpam Team > Email spoofing explained: display-name, exact-domain and lookalike spoofing with examples, what SPF, DKIM and DMARC catch, and how to spot a spoofed email. ## Short answer Email spoofing is sending a message with a forged sender so it appears to come from someone else. Attackers fake the display name, your exact domain, or a lookalike domain. SPF, DKIM and DMARC at enforcement stop exact-domain spoofing at receivers that check them. They don't stop display-name tricks or lookalike domains. Email was designed in an era of trust, so the sender address on a message is just text the sender types. Spoofing exploits that. Microsoft [describes](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-protection-spoofing-about) spoofed messages as ones that "appear to originate from someone or somewhere other than the actual source." This guide explains the three common kinds, what SPF, DKIM and DMARC do about each, and what they leave to you. ## What is email spoofing? Every email has two sender addresses, and attackers can fake either: - **The envelope sender** (also called `MAIL FROM` or the return path). Servers use it for bounces. Recipients rarely see it. - **The From header.** This is the address your mail app shows. It usually has a display name too, like `"Jane Smith" `. People judge a message by the From header, so that's what spoofers target. Microsoft's anti-spoofing technology "specifically examines forgery of the From header field," because email clients show it as the sender. Spoofing is a technique, not an attack in itself. It's used to make phishing, invoice fraud and malware look trustworthy. Business email compromise often starts with a spoofed message from a "boss" or "supplier." For the bigger picture, read our guide on [business email compromise prevention](https://iblockspam.com/blog/business-email-compromise-prevention). ## What are the types of email spoofing? | Type | What the recipient sees | Real sender | Stopped by SPF, DKIM and DMARC? | |---|---|---|---| | Display-name spoofing | `"Jane Smith (CEO)" ` | A free mailbox the attacker controls | No | | Exact-domain spoofing | `jane@example.com` | An unauthorized server | Yes, with DMARC at quarantine or reject | | Lookalike domain | `jane@examp1e.com` or `jane@example-billing.com` | A domain the attacker registered | No | ### Display-name spoofing The attacker sets the display name to someone you trust and uses any address they like. Many mail apps, especially on phones, show only the name. The message comes from a real, correctly configured free mailbox, so it passes every authentication check. DMARC doesn't try to fix this. [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html), section 2.4, lists "attacks in the display name portions of the RFC5322.From header field" as out of scope. ### Exact-domain spoofing The attacker puts your real domain in the From header and sends from their own server. A customer sees `accounts@yourcompany.com` and has no visual reason to doubt it. This is the type email authentication was built for. A related case is self-to-self spoofing, where a message to your staff claims to come from your own domain. Microsoft calls this intra-org spoofing and flags it separately from cross-domain spoofing. ### Lookalike domains The attacker registers a domain that looks like yours: a swapped letter (`rn` for `m`), a different top-level domain, an added word like `-invoices`, or characters from another alphabet that look identical. Because they own the domain, they can publish valid SPF, DKIM and even DMARC records for it. Every check passes, honestly. RFC 9989 is explicit that DMARC "does not address the use of visually similar domain names." Our guide to [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing) covers how to watch for them. ## How do SPF, DKIM and DMARC stop exact-domain spoofing? Each record does part of the job. Only together do they protect the From address people see. ### SPF checks the sending server SPF ([RFC 7208](https://www.rfc-editor.org/rfc/rfc7208.html)) lets you publish the servers allowed to send for your domain. But it checks the envelope sender and the HELO name, not the From header. The RFC says checking other identities against SPF records is "NOT RECOMMENDED." So an attacker can use their own domain in the envelope, pass SPF for it, and still put your domain in the From header. ### DKIM checks a signature DKIM ([RFC 6376](https://www.rfc-editor.org/rfc/rfc6376.html)) adds a signature that proves a domain took responsibility for the message and that signed parts weren't changed. The signing domain (`d=`) doesn't have to match the From address. The RFC says it "does not require the value of the SDID or AUID to match an identifier in any other message header field." An attacker can sign with their own domain. ### DMARC ties them to the From address DMARC closes the gap. A message passes DMARC only if SPF or DKIM passes **and** the domain that passed is aligned with the domain in the From header. By default, alignment is relaxed, so `mail.example.com` aligns with `example.com`. The domain owner also publishes a policy: - `p=none`: monitor only. Receivers don't act on failures because of DMARC. - `p=quarantine`: treat failures as suspicious, usually by sending them to junk. - `p=reject`: refuse failing messages. Here's how an exact-domain spoof plays out against each policy: 1. An attacker sends `From: billing@example.com` from a server not in example.com's SPF record and without example.com's DKIM key. 2. The receiver checks SPF. Either it fails for `example.com`, or it passes for the attacker's envelope domain, which isn't aligned. 3. The receiver checks DKIM. There's no valid signature from `example.com`. 4. DMARC fails, because neither check produced an aligned pass. 5. The receiver looks up example.com's DMARC policy. At `p=none`, it decides using its other signals and may deliver the message. At `p=quarantine` or `p=reject`, it junks or refuses it. That's why the FTC [tells small businesses](https://www.ftc.gov/business-guidance/blog/2019/02/cybersecurity-small-business-email-authentication) to use all three tools, and why Google's [sender guidelines](https://support.google.com/mail/answer/81126) require DMARC from bulk senders. Publishing `p=none` forever gives you reports but little protection. Our guide on [DMARC record examples](https://iblockspam.com/blog/dmarc-record-examples) shows what each policy looks like. ## What don't SPF, DKIM and DMARC stop? Being honest about the limits helps you cover them. - **Display-name spoofing.** Out of scope, as above. - **Lookalike domains.** The attacker's own records pass. - **Compromised accounts.** If an attacker signs in to a real mailbox at a supplier, their mail is genuinely from that domain and passes everything. - **Receivers that don't enforce.** DMARC is a request. Each receiving system decides how to apply it. Microsoft, for instance, notes that a failed check "doesn't directly result in blocking a message" and combines it with other signals. - **Your domain at `p=none`.** Receivers get no instruction to act. - **Domains you don't send from.** A parked domain with no records is easy to spoof. Publish an SPF record of `v=spf1 -all` and a DMARC record of `p=reject` for every domain that never sends mail. So authentication protects **your** domain from being forged. Protecting **your inbox** from the other kinds of spoofing takes filtering and people. ## How can you tell if an email is spoofed? You can't always tell from the inbox view, but the headers rarely lie about authentication results. Use this check on any message that asks for money, credentials or urgency. 1. **Look at the full sender address.** Tap or hover over the name. A display name of your CEO with a free mailbox address behind it is the most common trick. 2. **Compare the domain letter by letter.** Look for swapped letters, extra words, hyphens and unusual endings such as `.co` instead of `.com`. 3. **Check the Reply-To address.** A spoofed message often sends replies somewhere other than the From address. 4. **Open the headers.** Find the `Authentication-Results` line. Look for `spf=`, `dkim=` and `dmarc=` results and note which domain each one refers to. 5. **Read the result in context.** `dmarc=fail` on a message claiming to be from a known company is a strong warning. `dmarc=pass` only tells you the domain is real. It doesn't tell you the domain is the one you think it is. 6. **When money is involved, call.** Use a phone number you already have, not one in the message. If you find a spoof that got through, report it to your email admin so it can be removed from other mailboxes and the filter rules tightened. A message that appears to come from your own address and claims you've been hacked is a common example; see our guide to [sextortion scam emails](https://iblockspam.com/blog/sextortion-scam-emails). ## How do you protect your business from spoofing? There are two jobs. First, stop people forging **your** domain: publish SPF, sign with DKIM and move DMARC to enforcement, then lock down domains that never send mail. Our step-by-step guide to [stopping spoofing of your domain](https://iblockspam.com/blog/stop-email-spoofing-of-your-domain) covers each record, subdomains and parked domains. Second, stop the other kinds of spoofing reaching **your** inbox. Use filtering that enforces other domains' DMARC policies, require sender verification on allow-list entries (see our [allow and block lists](https://iblockspam.com/features/allow-block-lists) page), label external mail, and train people to verify payment requests. NIST's [phishing guidance](https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/phishing) says to "verify the request by using known contact information." For a wider plan, see our [email security checklist for small businesses](https://iblockspam.com/blog/email-security-checklist-small-business). ## Next steps 1. Run the free [Email Health Check](https://iblockspam.com/tools/email-health-check) to see whether your domain has SPF, DKIM and an enforcing DMARC policy. 2. If DMARC is at `p=none` or missing, start the move to enforcement this month. The [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator) builds the record for each step. 3. List the domains your business owns, and lock down any that don't send mail. 4. Share the display-name and lookalike examples above with anyone who approves payments. Related: [someone is sending email from my address](https://iblockspam.com/blog/someone-sending-email-from-my-address) walks through what to check if it's happening to you. Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats). ## Frequently asked questions ### Is email spoofing illegal? Forging a sender address is technically easy, and the legal position depends on what the sender does with it and where. Using spoofed email to commit fraud, steal credentials or demand payments is a crime in many countries. In the US, you can report spoofing-based fraud to the FBI's Internet Crime Complaint Center. ### Can someone spoof my exact email address? Yes. Nothing in SMTP stops a server from writing your address in the From field. Whether the message gets delivered depends on your domain's records. With SPF, DKIM and a DMARC policy of quarantine or reject, receivers that check DMARC can junk or refuse it. With no DMARC, many will deliver it. ### How do I know if my domain is being spoofed? Publish a DMARC record with a rua reporting address. Receivers then send daily aggregate reports listing the servers that sent mail using your domain and whether it passed. Unknown servers failing authentication usually mean spoofing. Bounces for mail you never sent and customer complaints are other signs. ### Does DMARC stop all phishing that uses my company name? No. DMARC only covers your exact domain in the From address. It doesn't stop a fake display name on a free email account, a lookalike domain, or a message from a real but compromised mailbox. Those need filtering, staff awareness and payment verification steps. ### What is the difference between spoofing and phishing? Spoofing is a technique: forging who a message appears to come from. Phishing is a goal: tricking someone into handing over credentials, money or access. Many phishing emails use spoofing to look trustworthy, but phishing can also come from genuine accounts, and spoofing can be used for spam that isn't phishing. ## Sources - [RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)](https://www.rfc-editor.org/rfc/rfc9989.html) - [RFC 7208: Sender Policy Framework (SPF)](https://www.rfc-editor.org/rfc/rfc7208.html) - [RFC 6376: DomainKeys Identified Mail (DKIM) Signatures](https://www.rfc-editor.org/rfc/rfc6376.html) - [Microsoft Learn: Anti-spoofing protection](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-protection-spoofing-about) - [FTC Business Blog: Cybersecurity for small business: Email authentication (2019)](https://www.ftc.gov/business-guidance/blog/2019/02/cybersecurity-small-business-email-authentication) - [NIST Small Business Cybersecurity Corner: Phishing](https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/phishing) - [Google: Email sender guidelines](https://support.google.com/mail/answer/81126) ## Free tools for this guide - [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject. - [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator): Build a DMARC record with the right policy, reporting and alignment settings. - [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings. - [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength. --- Source: iBlockSpam, https://iblockspam.com/blog/what-is-email-spoofing (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt