Home / Knowledge hub / Email spoofing
Knowledge hub
Email spoofing
Sending email that appears to come from your domain when it does not.
What it means
Email spoofing is sending a message whose From address has been forged, so it looks as if it came from someone else, such as your domain or your CEO. The original email system never checked that the sender owns the address they claim.
Think of the From line as the return address on a paper envelope. Anyone can write anything there. Modern defences add checks on top of the old system, but only if the domain owner sets them up and the receiving side enforces them.
Why it matters
Spoofed mail is a main tool for phishing and business email compromise. A fake invoice that seems to come from your finance team, or a password reset sent in your name, damages customers and your reputation even though your systems were never breached.
It also hits deliverability. Without proper records, real emails from your product, such as receipts and sign-in links, can land in spam, while forged ones sometimes get through. Customers cannot tell the difference between the two. Fixing it is mostly three DNS records and some patience.
How it shows up
Three DNS-based records work together. SPF lists the servers allowed to send for your domain. DKIM adds a cryptographic signature to each message. DMARC ties them to the visible From address and tells receivers what to do with mail that fails: nothing, quarantine, or reject.
Common gaps: no DMARC record, a policy left at none forever, an SPF record that allows far too much, and subdomains nobody set up. Lookalike domains with a changed letter are not covered by any of these, because they are different domains. Application features that send email from user input can also be abused; see email header injection.
Questions people ask
Email spoofing, answered
Can someone really send email from my domain?
Without SPF, DKIM and an enforced DMARC policy, receivers have little to check against, and forged mail may be delivered to inboxes.
With a reject policy in place, major receivers will refuse mail that fails the checks and is aligned to your domain.
Does DMARC stop all spoofing?
It stops forged mail that uses your exact domain in the From address, where the receiver enforces the policy. It does not stop lookalike domains or display-name tricks.
Staff awareness and monitoring still matter alongside it.
How do I check if my domain can be spoofed?
Look up your domain's SPF and DMARC records. A missing DMARC record, or a policy of none, means nothing is enforced against forged mail.
Online checkers and your mail provider's admin tools will show the result in a minute.
Is spoofing the same as phishing?
No. Spoofing is the forged sender. Phishing is the trick that uses it, or a lookalike domain, to get someone to click, pay or hand over a password.
Spoofing is one common way phishing is delivered.
What is a safe way to roll out DMARC?
Start with a policy of none and read the reports to find all your legitimate senders. Then move to quarantine, and finally to reject.
Skipping the reporting stage can block your own invoices and password emails.
Sources
Where this comes from
Related
Terms that sit next to this one
SPF
A DNS record listing which servers may send email for your domain.
DKIM
A signature on outgoing email that proves it came from your domain and is unaltered.
DMARC
A DNS policy telling receivers what to do with email that fails SPF and DKIM.
Phishing
Persuading someone to hand over credentials by posing as a trusted sender.
Business email compromise
Fraud using a hacked or faked work email to redirect payments or data.
Can your app be used to forge mail?
Features that send email can be bent to forge sender details or inject headers. We test those flows in your running app and prove any weakness with the request and the response. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.