Email Spoofing Explained
How Email Spoofing Forges the Sender
Email spoofing is sending a message with a forged sender address so that it appears to come from someone else. Because standard email has no built-in sender verification, a convincing forgery can pass for a genuine message.
Spoofing works because an email carries two different sender addresses. The envelope sender, also called the return path or MAIL FROM, is used by mail servers to route bounces and is normally hidden from the reader. The header From is the address shown in the mail client. A spoofer can set the header From to a trusted name while sending from their own server, so the recipient sees a familiar sender.
Spoofing is a common step in phishing, where a message pretends to be a bank, a supplier or a colleague in order to request a payment or a password. It can also harm innocent domain owners. When spam is sent with someone else's name, bounces and complaints flow back to the real owner of that name.
Lookalike Domains and Display Name Tricks
Not every fake message forges the domain itself. Attackers often register a lookalike domain, one that differs by a single letter, uses a different ending or swaps in a character that looks similar. A message from such a domain can be properly authenticated for that domain and still deceive a reader who does not look closely.
A related method uses the display name, the friendly text such as "Accounts Team" that appears before the address. The display name can say anything, so the address behind it is the part to check. Some mail clients emphasize the name and hide the address, which makes this trick effective.
Standards That Help Prevent Spoofing
The main defense is domain-level authentication. SPF lets a domain list the servers allowed to send for it. DKIM adds a cryptographic signature that proves the message was signed with the domain's key and was not changed. DMARC then requires that the authenticated domain match the visible From address and tells receivers what to do when it does not.
Authentication only protects a domain that publishes it. A domain without a DMARC policy gives receivers no instruction, so spoofed messages from it are judged on other signals alone. DMARC reports also help domain owners see every source that sends mail under their name, including unauthorized ones.
When the origin of a message is in doubt, its headers show more. The main header fields reveal the route a message took and the results of authentication checks.
Frequently asked questions
Can DMARC stop all email spoofing?
No. DMARC protects the exact domain it is published for, and only when the policy is enforced and receivers honor it. It does not stop lookalike domains, which are separate names that DMARC cannot cover, and it does not stop phishing sent from a genuinely compromised account. It is the most effective standard against forging a domain's own name, but it is not a complete solution.
What is the difference between spoofing and phishing?
Spoofing is the forging of a sender address. Phishing is an attempt to trick someone into a harmful action, such as giving away login details or paying a fake invoice. Phishing often uses spoofing, but it can also rely on a lookalike domain or a compromised real account, which spoofing controls alone do not catch.