Email Spoofing: How Attackers Fake Trusted Senders

The "From" line in your inbox is not a fact. It is a suggestion.

Email spoofing exploits that gap. An attacker writes whatever sender address they want, and unless your domain is configured to stop them, the message lands looking exactly like it came from your CEO, your bank, or your supplier.

This guide explains how email spoofing works, how SPF, DKIM and DMARC shut it down, and the one-minute header check any employee can run before acting on a suspicious message.

What Is Email Spoofing?

Email spoofing is the practice of sending a message with a forged sender address so the recipient believes it came from someone they trust. In practice, email spoofing is less a hacking technique than an abuse of a design assumption.

The technique does not require hacking anything. It requires only that the sending domain has not published the right DNS records, or that the recipient never checks.

Why SMTP Lets Anyone Forge a Sender

The protocol that moves mail across the internet was designed in an era of mutual trust between a small number of hosts.

The sender address shown in a mail client is set by the sender, not verified by the protocol.

There is no built-in identity check between sending and receiving servers.

Authentication was bolted on later through DNS records, and it remains optional.

That last point matters. A domain with no published policy is a domain anyone can impersonate.

Spoofing vs. Phishing vs. Account Takeover

These three get used interchangeably, and they are not the same thing.

Email spoofing forges the sender address. The attacker never touches the real mailbox.

Phishing is the goal: tricking someone into clicking, paying, or handing over credentials. Spoofing is one delivery method.

Account takeover means the attacker actually controls a real mailbox. Messages come from the genuine account, so authentication checks pass cleanly.

Account takeover is harder to detect precisely because nothing is forged. For the broader landscape, see our guide to types of phishing attacks.

Types of Email Spoofing Attacks

Not all email spoofing is technically identical, and the defences differ by type.

Display-Name Spoofing

The attacker sets the display name to "Ahmed Al-Otaibi, CFO" while the actual address is a free webmail account. On a phone, most clients show only the display name.

This is the most common variant because it needs no infrastructure at all.

Exact-Domain Spoofing

The attacker sends mail claiming to be from your real domain. This is the classic form of email spoofing, and it is the one DMARC was built to eliminate.

Lookalike and Cousin Domains

Instead of forging your domain, the attacker registers one that reads almost the same.

Character swaps: `rn` for `m`, `1` for `l`, `0` for `o`.

Different TLD: `.co` instead of `.com`.

Added words: `company-payments.com` instead of `company.com`.

DMARC does not stop these, because the attacker legitimately owns the lookalike domain.

Reply-To Manipulation

The From line looks genuine, but the Reply-To header points somewhere else. The victim replies, and the conversation quietly moves to the attacker.

How SPF, DKIM and DMARC Block Email Spoofing

These three DNS records are the technical answer to email spoofing. They work as a stack, not as alternatives, and skipping any one of them leaves a usable gap.

SPF — Who Is Allowed to Send

Sender Policy Framework publishes a list of IP addresses and services authorised to send mail for your domain. A receiving server checks the sending IP against that list.

DKIM — Proving the Message Wasn’t Altered

DomainKeys Identified Mail attaches a cryptographic signature to each message. The recipient verifies it against a public key in your DNS, confirming both that your domain authorised the message and that the content was not modified in transit.

DMARC — The Policy Layer

DMARC ties SPF and DKIM together and tells receiving servers what to do when checks fail.

`p=none` — monitor only. Nothing is blocked. This is a starting point, not a destination.

`p=quarantine` — send failures to the spam folder.

`p=reject` — block unauthenticated messages outright.

DMARC also adds alignment: the domain that passed SPF or DKIM must match the domain in the visible From address. Without alignment, an attacker could pass SPF on their own domain while displaying yours.

Why SPF Alone Is Not Enough

Plenty of organisations publish SPF, stop there, and assume they are protected. They are not.

SPF checks the envelope sender, not the From address the user actually sees.

SPF breaks when mail is forwarded.

Without a DMARC policy, a failed SPF check often results in nothing happening at all.

The combination is what closes the gap. A domain on `p=reject` with aligned SPF and DKIM is genuinely hard to impersonate.

The One-Minute Header Check Any Employee Can Run

Technical controls protect your domain. They do not protect your staff from a lookalike domain or a poorly configured partner. This is where the header check earns its place.

Opening Raw Headers

Gmail: open the message, click the three-dot menu, choose "Show original".

Outlook desktop: double-click to open the message, then File, Properties, and read the Internet headers box.

Apple Mail: select the message, then View, Message, Raw Source.

Reading the Authentication-Results Line

This single line is the fastest tell. Look for three values:

`spf=` — pass, fail, softfail, neutral, or none.

`dkim=` — pass or fail.

`dmarc=` — pass or fail.

For a message genuinely sent by a bank, government body, or well-run company, all three should read `pass`. A `fail` on a message claiming to be from a major institution is a strong signal of email spoofing.

Matching From vs. Return-Path

Compare the visible From domain against the Return-Path domain. A mismatch is not always malicious, since mailing lists and marketing platforms legitimately differ, but combined with a failed check it is a reliable red flag.

Red Flags Beyond the Headers

Most employees will never open a header. Train them on the behavioural signals of email spoofing instead:

A request that combines urgency with secrecy.

A change to payment or bank details, however small.

Reply-To pointing to a different domain than From.

Slight misspellings in the domain that only appear on close reading.

A first-time sender asking for something a long-standing process already covers.

Pressure to bypass the normal approval chain.

An unexpected attachment or a link whose preview URL does not match the anchor text.

Our guide on how to recognize phishing emails walks through each of these with examples.

How to Harden Your Domain Against Email Spoofing

Reducing email spoofing risk on your own domain is a sequence, not a switch. Work through this in order, because skipping to `p=reject` on day one will break legitimate mail.

Inventory every service that sends mail on your behalf, including marketing tools, ticketing systems, and ERP notifications.

Publish an SPF record covering all of them, staying within the DNS lookup limit.

Enable DKIM signing on every sending platform.

Publish DMARC at `p=none` with an aggregate report address.

Read the reports for several weeks and fix every legitimate source that fails alignment.

Move to `p=quarantine` and monitor for breakage.

Move to `p=reject` once reports are clean.

Register the obvious lookalike domains before someone else does.

Publish a DMARC record on parked domains you never send from.

Add external-sender banners in your mail gateway.

Common Email Spoofing Scenarios in the Workplace

Knowing the shape of the attack matters more than knowing the protocol. These are the patterns that actually land.

The Supplier Bank-Detail Change

An email spoofing a long-standing supplier arrives just before a scheduled payment, announcing new bank details. The invoice looks right because the attacker has seen a real one.

The CEO Gift-Card Request

A short, informal message from a spoofed executive address asks a junior employee to buy gift cards discreetly. The low amount is deliberate: it stays under approval thresholds.

The Fake Internal IT Notice

An email spoofing your own helpdesk warns that a mailbox will be deactivated unless the user re-authenticates. The link leads to a convincing login page.

The Payroll Redirect

A message spoofing an employee asks HR to update their salary account before the month-end run. It succeeds because the request looks routine rather than urgent.

Every one of these relies on a plausible business context, not on technical sophistication.

What to Do When Your Domain Is Being Spoofed

If customers or partners report messages you never sent:

Check your DMARC aggregate reports to identify the sending sources.

Confirm your policy is at `quarantine` or `reject`, not `none`.

Warn recipients through a channel you control, such as your website or an established contact list.

Preserve full headers from any sample message for investigation.

If a lookalike domain is involved, pursue takedown with the registrar.

Note the distinction: if messages pass authentication and you did not send them, this is not email spoofing. It is account compromise, and the response is entirely different.

Conclusion

Email spoofing survives because the protocol trusts the sender and most domains never publish a policy that says otherwise.

Email spoofing requires no hacking, only an unprotected domain.

SPF, DKIM and DMARC together close the exact-domain gap.

DMARC at `p=none` protects nothing. Progress to `reject`.

Lookalike domains bypass authentication entirely, so people remain the last control.

The Authentication-Results header gives any employee a one-minute verdict.

Train Your Team to Spot Spoofed Mail

DNS records protect your domain. They do not protect your staff from a convincing lookalike or a compromised supplier account.

PHISH-X runs realistic phishing simulations built on the same techniques attackers use, then measures who clicks, who reports, and how fast. Book a demo to establish your baseline click-rate and watch it fall over successive campaigns.

To discuss a programme sized for your organisation, contact the CyberX team or explore the full platform from our home page.

Frequently Asked Questions

Is email spoofing illegal?

Email spoofing used to defraud or impersonate is a criminal offence in most jurisdictions. Sending forged messages to defraud or impersonate is a criminal offence in most jurisdictions, including under Saudi Arabia’s anti-cybercrime law. Prosecution is difficult when attackers operate across borders, which is why prevention matters more than recourse.

Can DMARC stop all spoofing?

No. DMARC stops exact-domain forgery of domains you control. It does nothing against lookalike domains, display-name tricks, or messages sent from genuinely compromised accounts.

How do I know if my domain has DMARC?

Query the DNS TXT record at `_dmarc.yourdomain.com`. If nothing is returned, you have no policy and your domain can be impersonated freely.

What should an employee do with a suspected spoofed email?

Do not click, reply, or forward it to colleagues. Report it through your organisation’s reporting button or security mailbox, then verify any request through a known phone number. Understanding what phishing is makes that instinct automatic.

Does email spoofing require the attacker to hack my mail server?

No, and this is the common misconception. Standard forgery happens entirely on the attacker’s own infrastructure. Your server is never touched, which is why there is nothing in your logs to find. See Wikipedia’s overview of email spoofing for the protocol-level detail.