Domain Spoofing

This guide is part of our complete guide to email spoofing. Related: how to prevent email spoofing and display-name spoofing.

Domain spoofing is the most damaging form of email forgery: the attacker puts your exact domain in the From address — accounts@yourcompany.com, not a look-alike — so the message is indistinguishable from real mail at a glance. It is the technique behind the most convincing invoice fraud and CEO-impersonation attacks, and it is also the one your DNS records can stop outright.

Why domain spoofing is possible

The Simple Mail Transfer Protocol was designed in an era of implicit trust and never required a sender to prove ownership of the domain they claim. Two separate addresses ride in every message — the envelope MAIL FROM and the header From your recipient actually sees — and by default a receiving server validates neither against the domain’s DNS. An attacker simply writes your domain into those fields. No account is compromised; the domain is just being impersonated.

How to tell your domain is being spoofed

• Backscatter: you receive bounce notifications for emails you never sent, because spoofed mail to invalid addresses bounces back to the forged sender — you.
• Recipient reports: customers or partners forward “your” messages that you didn’t send.
• DMARC aggregate reports: the definitive signal. Once you publish DMARC, receivers send you XML reports showing exactly which IP addresses are sending mail that claims to be your domain — spoofing shows up as authentication failures from addresses you don’t own.

How to stop domain spoofing

Because the attacker is using your real domain, this is precisely what email authentication was built to defeat:

1. Publish SPF listing every server allowed to send for your domain, ending in -all so anything else is rejected. Keep it valid and under the 10-lookup limit — a broken SPF record disables this protection silently. Audit it with the SPF Checker.
2. Add DKIM so each message carries a cryptographic signature tied to your domain.
3. Publish DMARC with alignment, and move it to p=reject once your reports are clean. This tells the world’s receivers to refuse any message that forges your domain but fails authentication.

With all three in place and enforced, a message that spoofs your exact domain fails SPF and DKIM alignment and is rejected before it reaches an inbox. The single most common reason this protection lapses is an SPF record that has quietly grown past 10 lookups — which is exactly what AutoSPF prevents by keeping the record flattened automatically.

Frequently Asked Questions

What is the difference between domain spoofing and display-name spoofing?

Domain spoofing forges your exact domain in the From address, so SPF, DKIM, and DMARC can detect and reject it. Display-name spoofing only fakes the visible sender name while sending from the attacker’s own (authenticated) domain, so DNS records can’t block it on their own.

How do I stop someone from spoofing my domain?

Publish SPF (ending in -all), DKIM, and a DMARC policy set to p=reject. Together they let receiving servers verify that mail claiming your domain actually came from an authorized server, and reject it when it doesn’t. Keep the SPF record under the 10-lookup limit so it stays valid.

Does DMARC prevent domain spoofing?

Yes — DMARC with a p=reject policy is what instructs receivers to refuse messages that forge your domain but fail SPF and DKIM alignment. DMARC needs valid SPF and/or DKIM underneath it to work, which is why the three are deployed together.

Can I see who is spoofing my domain?

Yes. DMARC aggregate (rua) reports list the IP addresses sending mail that claims to be your domain, along with whether each passed or failed authentication. Reviewing them reveals both spoofing sources and any legitimate senders you forgot to authorize.