--- title: "Email Spoofing: How It Works & How to Stop It | AutoSPF" description: "What email spoofing is, how attackers forge your sender address, the types (domain, display-name, look-alike), and how SPF, DKIM and DMARC stop it. A complete guide." image: "https://autospf.com/images/og-default.png" canonical: "https://autospf.com/email-spoofing/" --- Email Security # Email Spoofing How attackers forge your sender address — and how SPF, DKIM, and DMARC shut it down. **Email spoofing** is the forgery of an email’s sender address so a message appears to come from someone it doesn’t. Because the classic SMTP protocol never verified who was allowed to use a domain in the `From` line, an attacker can put _your_ domain on an email they send from _their_ server — and, without the right DNS records in place, receiving servers have no reliable way to catch it. Spoofing is the engine behind most phishing, business email compromise (BEC), and invoice fraud, and the defense is the same trio of DNS records this site is built around: **SPF, DKIM, and DMARC**. ## How email spoofing works Every email actually carries _two_ sender identities. There’s the **envelope sender** (the `MAIL FROM` address used during the SMTP conversation) and the **header From** (the friendly address your mail client displays). Attackers exploit the gap between them: 1. The attacker connects to a mail server and starts a normal SMTP session. 2. In the message headers they simply _write_ your domain into the `From` field — nothing stops them typing `billing@yourcompany.com`. 3. The receiving server delivers the message. Unless your domain publishes authentication records, the recipient sees a trusted-looking sender and no warning. Nothing is “hacked” in a spoofing attack — no password is stolen and no server is breached. The attacker is abusing the fact that, by default, a domain doesn’t declare **which servers are allowed to send on its behalf**. That declaration is exactly what SPF, DKIM, and DMARC provide. ## The main types of email spoofing Spoofing shows up in several distinct forms, each with its own tell and its own fix: - **[Domain spoofing](/email-spoofing/domain-spoofing/)** — the attacker forges your exact domain in the `From` address. This is what SPF, DKIM, and DMARC directly prevent. - **[Display-name spoofing](/email-spoofing/display-name-spoofing/)** — the visible name reads “Your CEO” while the real address behind it is a free webmail account. DMARC can’t block this alone, because the sending domain is genuinely the attacker’s. - **Look-alike / cousin domains** — messages come from `yourcompany-support.com` or `yourcompanny.com`, domains the attacker actually owns and can authenticate. Defeating these needs monitoring and user awareness, not just SPF. - **Echo / reply-chain spoofing** — attackers reuse a real, previously-sent thread to make a forged reply look legitimate. Knowing which type you’re facing tells you whether authentication records will stop it outright or whether you also need [protection tooling and monitoring](/email-spoofing/email-spoofing-protection/). ## How SPF, DKIM and DMARC stop spoofing The three records work as a layered check on every inbound message: - **SPF** publishes the list of IP addresses allowed to send mail for your domain. A receiver checks whether the sending server is on that list. Build and audit yours with the [SPF Checker](/tools/spf-checker/). - **DKIM** adds a cryptographic signature that proves the message wasn’t altered and really came from your domain. - **DMARC** ties SPF and DKIM to the visible `From` address (alignment) and tells receivers what to do when a message fails — `none`, `quarantine`, or `reject`. Published together with a `-all` SPF policy and a `p=reject` DMARC policy, they make it practically impossible for an attacker to send domain-spoofed mail that lands in an inbox. Our full walkthrough on [how to prevent email spoofing](/email-spoofing/how-to-prevent-email-spoofing/) covers the exact records to publish. ## The catch: SPF alone isn’t enough — and it breaks quietly Publishing SPF is the first step, but SPF has a hard limit of **10 DNS lookups**, and every ESP, CRM, and marketing tool you authorize eats into it. Cross the limit and SPF returns `PermError`, which _invalidates the whole record_ — at which point legitimate mail starts failing and, worse, your anti-spoofing protection silently drops. This is the problem [AutoSPF](/) solves: it keeps your SPF record flattened and under the limit automatically, so the authentication that stops spoofing stays healthy as your sending stack changes. Pair it with DKIM and a `p=reject` DMARC policy and domain spoofing simply stops working. New to the underlying records? Start with [how to create an SPF record](/how-to-create-an-spf-record/) and the [SPF record syntax reference](/spf-record-format/), and make sure yours stays under the [10-lookup limit](/spf-too-many-dns-lookups/). ## Frequently Asked Questions ### What is email spoofing? Email spoofing is forging the sender address of an email so it appears to come from a person or domain that didn’t actually send it. It relies on the fact that basic SMTP doesn’t verify the `From` address, and it’s the primary technique behind phishing and business email compromise. SPF, DKIM, and DMARC are the DNS records that let receivers detect and reject it. ### Does SPF stop email spoofing? SPF stops attackers from forging your exact domain by telling receivers which servers may send for it — but only when it’s paired with DKIM and a DMARC policy set to `quarantine` or `reject`, and only while the SPF record stays valid under the 10-lookup limit. SPF on its own, or a broken SPF record, leaves gaps that spoofers exploit. ### Can email spoofing be completely prevented? Domain spoofing — forging your exact domain — can be effectively eliminated with SPF, DKIM, and a `p=reject` DMARC policy. Display-name and look-alike-domain spoofing can’t be blocked by your DNS records alone (the attacker isn’t using your domain), so those also need recipient awareness and monitoring. ### Is email spoofing the same as phishing? No. Spoofing is a _technique_ — forging the sender address — while phishing is the _goal_: tricking someone into revealing information or money. Most phishing uses spoofing, but not all. See [email spoofing vs phishing](/email-spoofing/spoofing-vs-phishing/) for the full distinction. ### How do I know if my domain is being spoofed? Signs include bounce messages for emails you never sent (backscatter), recipients reporting suspicious mail from your domain, and — most reliably — DMARC aggregate reports showing mail failing authentication from IPs you don’t recognize. Publishing DMARC (even at `p=none`) turns on that reporting. Go Deeper ## Email Spoofing, Explained in Depth [ How to Prevent Email Spoofing → The exact SPF, DKIM & DMARC records to publish to lock attackers out. ](/email-spoofing/how-to-prevent-email-spoofing/)[ Domain Spoofing → When an attacker forges your exact domain — and how DMARC stops it. ](/email-spoofing/domain-spoofing/)[ Display-Name Spoofing → The "CEO fraud" trick DNS records can’t block on their own. ](/email-spoofing/display-name-spoofing/)[ Email Spoofing Protection → Solutions, monitoring, and tooling beyond the base records. ](/email-spoofing/email-spoofing-protection/)[ Email Spoofing vs Phishing → How the technique differs from the attack it powers. ](/email-spoofing/spoofing-vs-phishing/) ## Keep the SPF that stops spoofing valid AutoSPF flattens your SPF record and keeps it under the 10-lookup limit automatically, so your anti-spoofing protection never silently breaks. [Start Free Trial→](https://subscriptions.zoho.com/subscribe/31162770c20bc42aba9c86185ed6106a6a2bba0f6b053217ad482bf477cf719e/smb%5F1)[View Plans & Pricing](/pricing/) Rated 5/5 on G2 · Trusted since 2018 ## What Our Customers Say ### "AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product" > It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF "flattens" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change. PJ Peter J. President · Small-Business (50 or fewer emp.) ### "Helped us go beyond capacity" > AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example. VU Verified User Financial Services · Mid-Market (51-1000 emp.) [Read our reviews on G2 ](https://www.g2.com/products/autospf/reviews) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.facebook.com/autospf","https://github.com/duocircle","https://www.g2.com/products/autospf/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"5.0","reviewCount":"21","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/autospf/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM","Email Deliverability","SPF Lookup Limits"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is email spoofing?","acceptedAnswer":{"@type":"Answer","text":"Email spoofing is forging the sender address of an email so it appears to come from a person or domain that didn't actually send it. It relies on the fact that basic SMTP doesn't verify the `From` address, and it's the primary technique behind phishing and business email compromise. SPF, DKIM, and DMARC are the DNS records that let receivers detect and reject it."}},{"@type":"Question","name":"Does SPF stop email spoofing?","acceptedAnswer":{"@type":"Answer","text":"SPF stops attackers from forging your exact domain by telling receivers which servers may send for it — but only when it's paired with DKIM and a DMARC policy set to `quarantine` or `reject`, and only while the SPF record stays valid under the 10-lookup limit. SPF on its own, or a broken SPF record, leaves gaps that spoofers exploit."}},{"@type":"Question","name":"Can email spoofing be completely prevented?","acceptedAnswer":{"@type":"Answer","text":"Domain spoofing — forging your exact domain — can be effectively eliminated with SPF, DKIM, and a `p=reject` DMARC policy. Display-name and look-alike-domain spoofing can't be blocked by your DNS records alone (the attacker isn't using your domain), so those also need recipient awareness and monitoring."}},{"@type":"Question","name":"Is email spoofing the same as phishing?","acceptedAnswer":{"@type":"Answer","text":"No. Spoofing is a *technique* — forging the sender address — while phishing is the *goal*: tricking someone into revealing information or money. Most phishing uses spoofing, but not all. See [email spoofing vs phishing](/email-spoofing/spoofing-vs-phishing/) for the full distinction."}},{"@type":"Question","name":"How do I know if my domain is being spoofed?","acceptedAnswer":{"@type":"Answer","text":"Signs include bounce messages for emails you never sent (backscatter), recipients reporting suspicious mail from your domain, and — most reliably — DMARC aggregate reports showing mail failing authentication from IPs you don't recognize. Publishing DMARC (even at `p=none`) turns on that reporting."}}]} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Email Spoofing","item":"https://autospf.com/email-spoofing/"}]} ``` ```json {"@context":"https://schema.org","@type":"Product","name":"AutoSPF","url":"https://autospf.com","aggregateRating":{"@type":"AggregateRating","ratingValue":5,"reviewCount":21,"bestRating":5,"worstRating":1},"review":[{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Peter J.","jobTitle":"President"},"datePublished":"2026-03-10","reviewBody":"It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF \"flattens\" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change.","name":"AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Verified User","jobTitle":"Financial Services"},"datePublished":"2025-07-31","reviewBody":"AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example.","name":"Helped us go beyond capacity","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}}]} ```