Email Spoofing

Email spoofing is the forgery of an email’s sender address so a message appears to come from someone it doesn’t. Because the classic SMTP protocol never verified who was allowed to use a domain in the From line, an attacker can put your domain on an email they send from their server — and, without the right DNS records in place, receiving servers have no reliable way to catch it. Spoofing is the engine behind most phishing, business email compromise (BEC), and invoice fraud, and the defense is the same trio of DNS records this site is built around: SPF, DKIM, and DMARC.

How email spoofing works

Every email actually carries two sender identities. There’s the envelope sender (the MAIL FROM address used during the SMTP conversation) and the header From (the friendly address your mail client displays). Attackers exploit the gap between them:

1. The attacker connects to a mail server and starts a normal SMTP session.
2. In the message headers they simply write your domain into the From field — nothing stops them typing billing@yourcompany.com.
3. The receiving server delivers the message. Unless your domain publishes authentication records, the recipient sees a trusted-looking sender and no warning.

Nothing is “hacked” in a spoofing attack — no password is stolen and no server is breached. The attacker is abusing the fact that, by default, a domain doesn’t declare which servers are allowed to send on its behalf. That declaration is exactly what SPF, DKIM, and DMARC provide.

The main types of email spoofing

Spoofing shows up in several distinct forms, each with its own tell and its own fix:

• Domain spoofing — the attacker forges your exact domain in the From address. This is what SPF, DKIM, and DMARC directly prevent.
• Display-name spoofing — the visible name reads “Your CEO” while the real address behind it is a free webmail account. DMARC can’t block this alone, because the sending domain is genuinely the attacker’s.
• Look-alike / cousin domains — messages come from yourcompany-support.com or yourcompanny.com, domains the attacker actually owns and can authenticate. Defeating these needs monitoring and user awareness, not just SPF.
• Echo / reply-chain spoofing — attackers reuse a real, previously-sent thread to make a forged reply look legitimate.

Knowing which type you’re facing tells you whether authentication records will stop it outright or whether you also need protection tooling and monitoring.

How SPF, DKIM and DMARC stop spoofing

The three records work as a layered check on every inbound message:

• SPF publishes the list of IP addresses allowed to send mail for your domain. A receiver checks whether the sending server is on that list. Build and audit yours with the SPF Checker.
• DKIM adds a cryptographic signature that proves the message wasn’t altered and really came from your domain.
• DMARC ties SPF and DKIM to the visible From address (alignment) and tells receivers what to do when a message fails — none, quarantine, or reject.

Published together with a -all SPF policy and a p=reject DMARC policy, they make it practically impossible for an attacker to send domain-spoofed mail that lands in an inbox. Our full walkthrough on how to prevent email spoofing covers the exact records to publish.

The catch: SPF alone isn’t enough — and it breaks quietly

Publishing SPF is the first step, but SPF has a hard limit of 10 DNS lookups, and every ESP, CRM, and marketing tool you authorize eats into it. Cross the limit and SPF returns PermError, which invalidates the whole record — at which point legitimate mail starts failing and, worse, your anti-spoofing protection silently drops. This is the problem AutoSPF solves: it keeps your SPF record flattened and under the limit automatically, so the authentication that stops spoofing stays healthy as your sending stack changes. Pair it with DKIM and a p=reject DMARC policy and domain spoofing simply stops working.

New to the underlying records? Start with how to create an SPF record and the SPF record syntax reference, and make sure yours stays under the 10-lookup limit.

Frequently Asked Questions

What is email spoofing?

Email spoofing is forging the sender address of an email so it appears to come from a person or domain that didn’t actually send it. It relies on the fact that basic SMTP doesn’t verify the From address, and it’s the primary technique behind phishing and business email compromise. SPF, DKIM, and DMARC are the DNS records that let receivers detect and reject it.

Does SPF stop email spoofing?

SPF stops attackers from forging your exact domain by telling receivers which servers may send for it — but only when it’s paired with DKIM and a DMARC policy set to quarantine or reject, and only while the SPF record stays valid under the 10-lookup limit. SPF on its own, or a broken SPF record, leaves gaps that spoofers exploit.

Can email spoofing be completely prevented?

Domain spoofing — forging your exact domain — can be effectively eliminated with SPF, DKIM, and a p=reject DMARC policy. Display-name and look-alike-domain spoofing can’t be blocked by your DNS records alone (the attacker isn’t using your domain), so those also need recipient awareness and monitoring.

Is email spoofing the same as phishing?

No. Spoofing is a technique — forging the sender address — while phishing is the goal: tricking someone into revealing information or money. Most phishing uses spoofing, but not all. See email spoofing vs phishing for the full distinction.

How do I know if my domain is being spoofed?

Signs include bounce messages for emails you never sent (backscatter), recipients reporting suspicious mail from your domain, and — most reliably — DMARC aggregate reports showing mail failing authentication from IPs you don’t recognize. Publishing DMARC (even at p=none) turns on that reporting.