Email spoofing is the forgery of an email's sender identity so a message appears to come from a person or domain it did not come from — your bank, your CEO, your own company. It works because the email protocol trusts whatever sender name a message claims, unless the receiving server checks authentication records that prove otherwise. This guide covers how spoofing works, why a familiar name in the inbox proves nothing, and the three DNS records that shut it down in 2026.
TL;DR
- Email spoofing forges the visible From address; the underlying mail protocol does not verify senders by itself.
- SPF, DKIM and DMARC are the authentication records that prove (or fail to prove) a sender is genuine; DMARC ties them to the visible From domain and tells receivers what to do on failure.
- A display name alone is not identity — anyone can write any name there without breaking anything technical.
- Deploying DMARC in monitor mode first, then quarantine, then reject is the accepted rollout.
- Staff training remains necessary because spoofing of individual people (not domains) and lookalike domains bypass authentication entirely.
What is email spoofing?
When an email arrives, the From address on it is text the sending software chose — nothing in basic email verifies it. An attacker who can operate a mail server (or use one of many free spoofing tools) can set the From field to anything: ceo@yourcompany.com, support@yourbank.com, or a colleague's personal address. The recipient sees the familiar name and, unless their mail server checked authentication records, nothing warns them.
The three records that close this hole work as a set: SPF verifies which mail servers may send for a domain, DKIM cryptographically signs messages so they cannot be altered, and DMARC requires that the passing check actually aligns with the visible From domain and publishes a policy for failures. The DMARC.org overview documents the design goal directly: to enable receivers to reject unauthenticated messages, closing the gap that SPF and DKIM alone leave open.
How email spoofing works
Three variants cover what staff actually encounter:
- Direct domain spoofing. Forged From header claiming your exact domain. This is the variant SPF, DKIM and DMARC stop: without a passing, aligned check, receiving servers quarantine or reject the message under your published policy.
- Display-name spoofing. The attacker puts "Your Bank" or "Alex from Accounting" in the display name and sends from any address at all. No DNS record can stop this, because no identity is actually claimed — only staff training catches it, by checking the actual address behind the name.
- Lookalike domains. Registered domains one letter off (rn for m, 0 for o) with valid SPF and DMARC of their own. Authentication passes because the domain is real; only human recognition of the mismatch stops it.
The split matters technically and strategically: the first variant is a DNS record problem, the other two are a training problem. A business that deploys DMARC but never trains staff has closed one of three doors.
What spoofing enables
| Spoofed sender | Typical payload | Realistic cost |
|---|---|---|
| Your CEO or CFO | Urgent wire transfer request | Direct financial loss, hardest to recover |
| Your own domain | Invoice with changed bank details | Customer payment redirected |
| A supplier or bank | Credential-harvesting login page | Account takeover, credential harvesting |
| A government agency | Fake ATO or myGov notice | Stolen tax credentials, staff panic |
Australian context: ASD received more than 84,700 cybercrime reports in FY2024-25 — one every six minutes — and payment redirection via spoofed or impersonated senders is among the most common small-business losses (ASD Annual Cyber Threat Report 2024-25).
How to stop email spoofing
- Publish SPF listing every service legitimately allowed to send as your domain.
- Enable DKIM signing on every outbound mail path.
- Publish DMARC starting at p=none with reporting, so you can see which legitimate services fail while blocking nothing — the DMARC.org five-step rollout is monitor, analyse, adjust, then move the policy to quarantine and finally reject.
- Move to quarantine, then reject. Once reports show all legitimate mail passes, p=reject tells receivers to bounce forged mail outright — the setting that actually protects your customers from mail pretending to be you.
- Train for the two variants authentication cannot touch. Display-name and lookalike spoofing sail through perfect DMARC: staff need the habit of checking the full sender address and verifying any payment change by phone. Cyber Aware's security awareness training drills exactly that habit monthly, phishing simulations rehearse the spoofed-executive and lookalike-domain lures before the real one lands, and a gap assessment confirms your own domain's authentication records are actually in place.
FAQ
What is email spoofing in simple terms? Forging the From address on an email so it appears to come from someone it did not come from.
How do I know if an email is spoofed? Check the full sender address, not just the display name, and inspect the message headers for SPF, DKIM and DMARC results; a familiar display name with a foreign address is the classic tell.
Does SPF alone prevent spoofing? No. SPF verifies the sending server, not the visible From domain — DMARC adds the alignment check and the failure policy that make spoofing fail.
How long does DMARC deployment take? Weeks to a few months: monitor mode first, until reports confirm all legitimate senders pass, then quarantine, then reject. Rushing to reject risks blocking your own real mail.
Can spoofing be stopped completely? Domain spoofing, yes — with enforced DMARC. Display-name and lookalike spoofing cannot be blocked technically, which is why staff training stays necessary.
What should staff do if they spot a spoofed email? Do not reply or click anything; report it with the email client's report button so the message is logged and pulled from other mailboxes.
One last thing
Look up your domain's DMARC record today — a free lookup in any DNS tool. If nothing is published, anyone on the internet can send mail as your company, and every customer with a spam folder has already seen an attempt.