What is Email Spoofing? How Attackers Fake Your Email Address
Email spoofing lets attackers send emails appearing to come from your domain. Learn how it works, the real-world damage it causes, and how SPF, DKIM, and DMARC stop it.
What is email spoofing?
Email spoofing is the creation of email messages with a forged sender address. Because the SMTP protocol (defined in the 1980s) has no built-in sender authentication, any mail server can send an email claiming to be from any address — including your CEO, your bank, or your company's support team.
Spoofed emails are used in phishing attacks, business email compromise (BEC), and spam campaigns. The recipient sees a legitimate-looking From address and is more likely to trust the message.
How email spoofing works
SMTP separates the 'envelope sender' (used for routing) from the 'From:' header (displayed to recipients). An attacker can send an email with: - A legitimate-looking From: header (e.g., ceo@yourcompany.com) - Their own envelope sender for any bounces - Content designed to trick recipients
This works because most email clients display only the From: header — not the actual sending server or routing information.
Types of spoofing: Exact domain spoofing: Forging your exact domain (stopped by DMARC p=reject) Display name spoofing: Faking the display name while using a different domain Lookalike domain attacks: Registering similar domains (yourcompany-security.com)
The real cost of domain spoofing
Business Email Compromise (BEC) caused over $2.9 billion in losses in 2023 according to the FBI's IC3 report. Attackers spoof executive email addresses to authorize wire transfers, redirect payroll, or trick employees into purchasing gift cards.
Beyond financial losses: spoofed emails from your domain damage your brand reputation, erode customer trust, and can result in your legitimate domain being blacklisted if the spoofed emails generate spam reports.
- $2.9B
- BEC losses (2023, FBI IC3)
- $51B+
- Total BEC losses (2013–2023)
- ~90%
- Phishing emails using spoofing
- ~70%
- Domains without DMARC enforcement
Top cybercrime by financial losses for the 5th consecutive year
Cumulative IC3 reported losses over 10 years
Of targeted phishing attacks impersonate known brands or domains
Of domains still at p=none or no DMARC as of 2024
How to stop email spoofing
The three-layer defense:
SPF: Publishes a list of authorized sending servers. Prevents unauthorized servers from passing SPF checks.
DKIM: Cryptographically signs outgoing emails. Messages not signed with your private key fail DKIM verification.
DMARC with p=reject: The critical layer. DMARC requires the visible From: domain to align with SPF or DKIM. p=reject tells receiving servers to block all unauthenticated emails claiming your domain. This stops exact domain spoofing entirely.
Loakalike domains can't be stopped by DMARC — register common typo variants and use trademark monitoring services.
Without DMARC (or p=none)
- →Anyone can send email as ceo@yourcompany.com
- →Spoofed emails delivered to recipient inboxes
- →Phishing campaigns freely impersonate your brand
- →BEC attacks use your exact domain with no friction
- →No visibility into who is sending as your domain
- →Spoofed emails may generate spam reports hurting your reputation
With DMARC p=reject
- →Unauthenticated emails blocked at receiving servers
- →Exact domain spoofing completely prevented
- →Phishing emails claiming your domain rejected by Gmail/Outlook/Yahoo
- →BEC attackers must use lookalike domains (much harder to trust)
- →Aggregate reports show all legitimate and illegitimate senders
- →Brand reputation protected from spoofing-generated spam reports
Check your domain's email health
Run a free scan against 60 blacklists. Validate SPF, DKIM, DMARC, and MX records in seconds.
Related free tools