Email spoofing is the forging of an email’s sender information so that a message appears to come from a trusted person or organisation rather than its real source.
How email spoofing works
The core email protocol, SMTP (RFC 5321), was designed without sender authentication: the “From” address is simply text that the sending server writes. Attackers abuse this in several ways:
- Exact-domain spoofing – using the real domain of a bank or company in the From header, which works if the domain has no strict authentication policy.
- Display name spoofing – showing a trusted name such as the CEO while the actual address is a free mailbox.
- Look-alike domains – registering a similar domain, for example with swapped letters.
- Reply-To manipulation – replies silently go to the attacker’s address.
Email spoofing is one form of spoofing and different from account compromise, where attackers send mail from a real hijacked mailbox.
Why email spoofing matters
Spoofed sender addresses make phishing and spear phishing far more convincing and are central to business email compromise, in which fake messages from executives or suppliers trigger fraudulent payments. Spoofing is also used to spread malware and to damage a brand’s reputation.
How to prevent email spoofing
- Publish SPF (RFC 7208) records that list servers allowed to send for your domain.
- Sign outgoing mail with DKIM (RFC 6376).
- Deploy DMARC (RFC 7489) and move gradually to a
p=rejectpolicy; since 2024 Google and Yahoo require DMARC for bulk senders. - Mark external emails in mail clients, flag look-alike domains and verify payment requests through a separate channel.
