.webp)
Email spoofing is when someone makes an email appear to come from a domain or sender they do not control, usually to make the recipient trust the message. It does not require a breach. An attacker can impersonate your domain without touching your email accounts, servers or passwords, by exploiting how email works and relying on the recipient to believe what they see.
For businesses, that creates a problem that sits between security and deliverability. A spoofing campaign can cause customers to report suspicious messages, legitimate campaigns to perform worse, and sender reputation to deteriorate before the security team realizes that someone is impersonating the company.
This guide covers how spoofing works, the techniques attackers use, and the warning signs that your domain or inbox is being targeted, then how to investigate suspicious activity, strengthen authentication, and limit the damage to both security and deliverability.
Key takeaways
- Spoofing needs no breach. SMTP was not designed to prove that the sender shown in an email is authorized to use that identity, so an attacker can impersonate your domain without touching your systems.
- Authentication stops one of the four common tactics. SPF, DKIM and enforced DMARC address exact domain spoofing. Display name spoofing, lookalike domains and compromised supplier accounts get through.
- The losses are large and under-reported. In 2025, the FBI’s IC3 recorded 24,768 Business Email Compromise complaints and $3.05 billion in reported losses, counting only incidents victims reported.
- DMARC reports show the scale, headers show the message. Aggregate reports, now defined in RFC 9990, reveal who sends as your domain across receiving networks, while headers investigate a single email.
- Spoofing can surface as a deliverability problem. Falling replies, weaker placement and rising complaints can trace back to forged mail outside your own sending, which DMARC enforcement keeps out of your domain’s reputation.
What is email spoofing?
Email spoofing is the practice of making an email appear to come from a sender, domain, or organization that did not actually send it. The attacker changes or manipulates the identity information associated with the message so that the recipient sees something they recognize and trust.
That does not mean someone has necessarily broken into your company. In many cases, the attacker has no access to your systems at all. They are simply taking advantage of the fact that traditional email delivery was not originally designed around strong sender identity verification.
Spoofing and phishing are related but different. Spoofing is the impersonation technique; phishing is the fraudulent activity or goal that the impersonation is often used to support. The FBI describes spoofing as a technique in which criminals disguise communications to appear to come from a known or trusted source.
That distinction matters because stopping one does not automatically stop the other. You can make it much harder to send unauthorized messages using your exact domain while still having attackers impersonate your employees through a lookalike domain or a legitimate compromised account.
How email spoofing works
The protocol used to transfer emails between mail servers, SMTP, was designed around a relatively simple model: one server tells another who the message is from, and the receiving server accepts and processes it. Modern authentication mechanisms were added later to establish stronger evidence about sender identity.
One of the most important distinctions is between the envelope sender and the visible From address. The receiving server uses the envelope information during delivery, while the recipient sees the From address in their inbox. SPF checks the domain associated with the envelope sender, not necessarily the address the recipient sees.
This is why SPF alone cannot prevent email domain spoofing. An attacker can send a message that passes SPF for one domain while displaying another in the From field. DMARC adds another layer by checking whether the authenticated domain aligns with the visible From address.
Two other email fields are worth understanding. The Reply-To address determines where replies go, so it may point somewhere different from the visible sender. The Received chain in the message headers records the mail servers involved in delivery, including information about the connecting IP addresses.
These details are particularly useful when investigating suspicious messages. The visible sender address tells you what the recipient sees, but authentication results and email headers can reveal much more about where a message came from and whether its claimed identity can be trusted.
The four ways attackers impersonate a domain
Not all spoofing works the same way, and authentication protects against some techniques far better than others. Attackers use four main strategies to impersonate a domain.
Display name spoofing
Display name spoofing is the simplest form. The attacker sends from an ordinary mailbox but sets the display name to something like the CEO's name, a finance manager's name, or the name of a trusted vendor.
Authentication does not stop this because the sending domain may be completely legitimate. If someone sends from a real consumer mailbox, that provider can correctly authenticate its own domain. The fact that the display name says "John Smith, CEO" does not change the authentication result.
Lookalike domains
A more convincing attack uses a domain that resembles the real one. The attacker may register a near-match or use a visually similar character and then send messages from that domain.
Authentication can pass because the attacker genuinely controls the domain being used. From an authentication perspective, there is nothing inherently fraudulent about the sending infrastructure.
The scale can be substantial. In 2024, Proofpoint reported that its telemetry saw about 23 million messages per day, on average, from unauthorized senders potentially spoofing trusted domains, and threat actors registering as many as 300 impersonation domains in a single day..
Exact domain spoofing
Exact domain spoofing is the case most people have in mind when they ask how to stop email spoofing. Here, the attacker attempts to make the message appear to come directly from your actual domain without being authorized to send for it.
This is where SPF, DKIM, and DMARC matter most. When DMARC is correctly deployed and enforced, a message claiming to come from your domain must pass an authentication check that is aligned with the visible From domain. Receivers can then apply the domain owner's requested policy to messages that fail.
As authentication enforcement has become more common, exact-domain spoofing has become a less attractive technique for attackers. Lookalike domains, display names, and compromised legitimate accounts remain outside the part of the problem that DMARC was built to solve.
Compromised supplier accounts
One of the hardest attacks to detect occurs when an attacker gains control of a legitimate supplier's email account. They can then send messages from the supplier's real domain and mailbox, making the communication look like an ordinary business exchange.
In this case, nothing needs to be forged. SPF, DKIM, and DMARC can all pass because the email comes from legitimate infrastructure and an authenticated account. The attacker may even take over an existing email conversation, making fraudulent invoices or requests for updated bank details particularly convincing.
This is what makes compromised accounts so difficult to detect. Unlike traditional spoofing, the problem isn't a forged sender identity but an unauthorized person using a legitimate one. Email authentication remains essential, but it cannot replace account security, suspicious activity monitoring, or independent verification of sensitive requests.
How to detect email spoofing
The first signs of email spoofing are not always found in a security dashboard. Sometimes they arrive as an annoyed customer asking why your company sent them an unusual invoice.
The key is to look at both the security signals and the business signals. The sections below cover the warning signs to watch for, how to use DMARC reports to investigate activity at scale, and how to inspect the headers of an individual message when you need to determine whether it really came from your domain.
The signs that show up first
On the security side, the clearest warning signs are customers or partners reporting messages you did not send, bounce notifications for emails nobody at your company sent, and unfamiliar sending sources appearing in authentication reports.
There can also be commercial signals. If your sender reputation declines even though your own sending behavior has not changed, inbox placement begins slipping, reply rates fall, or complaint rates increase, then spoofing should be part of the investigation.
Deliverability has many causes, so an unexplained change does not prove spoofing, but it is a reason to compare your legitimate sending activity with the authentication data for your domain.
Reading DMARC aggregate reports
If you want to know who is sending email claiming to use your domain at scale, DMARC aggregate reporting is the central source of evidence. There is no equivalent mechanism that gives a domain owner the same broad view of authentication activity across receiving networks.
RFC 9990, published in May 2026 as part of the update that replaced the original DMARC specification, defines aggregate reports as XML feedback that receivers send to an address the domain owner chooses. They cover messages claiming to come from the domain, their authentication results, and how the domain's policy was applied.
The reports contain information such as the sending source, authentication results, and how receiving systems handled the messages. Most teams use reporting software to turn the raw XML into something people can read.
The practical starting point is monitoring. Publish a DMARC policy that collects reports without immediately asking receivers to reject or quarantine failures. That gives you time to discover legitimate services that are sent on your behalf before moving toward enforcement.
Checking an individual message's headers
When you are investigating one suspicious message, headers provide a much more useful answer than looking at the visible sender.
Open the message's source or header information in your mail client and examine the authentication results. Look for SPF, DKIM, and DMARC results, whether the Return-Path aligns with the visible From domain, whether a DKIM signature is present, and what the Received chain says about the message's route.
A successful authentication result has a limit. It means the sending domain was authorized according to that authentication mechanism. It does not mean the message itself is trustworthy. A lookalike domain can authenticate perfectly, and a compromised legitimate mailbox can authenticate perfectly too.
How to tell if an email you received is spoofed
For an individual recipient, start with the identity rather than the formatting. Check whether the actual domain matches the organization you expected, whether the Reply-To address makes sense, and whether the request is consistent with previous communication.
Be especially careful with unexpected payment instructions, bank-account changes, requests for gift cards, password requests, or urgent requests to bypass the normal approval process. Pressure is often part of the attack because the less time you spend verifying the request, the less likely you are to notice the inconsistency.
The most effective countermeasure for a payment or bank-detail change is also one of the least technical: contact the supplier or colleague using a phone number or contact method you already have on file, rather than one supplied in the suspicious email. That single step protects against cases that authentication cannot solve, including compromised accounts and lookalike domains.
Why spoofing shows up as a deliverability problem first
Spoofing reaches the commercial side of a business through the domain name your legitimate email depends on. When unauthorized messages carry your domain in the From address, recipients report them as spam or phishing, and the trust they lose attaches to your brand. The exposure is highest while your domain has no enforced DMARC policy. Receivers have no instruction to reject the forged messages, so more of them reach inboxes, draw spam reports, and teach recipients to distrust mail carrying your name.
The result can be confusing. Sales sees fewer replies. Marketing sees weaker inbox placement. The deliverability team investigates content, lists, authentication and sending volume, while the cause sits outside the company's sending infrastructure altogether. Authentication therefore does two jobs at once: (1) it protects recipients from messages that impersonate you, and (2) it protects the reputation your real campaigns are judged on.
Google has made the same connection. Since February 2024 it has required bulk senders, meaning anyone sending close to 5,000 or more messages a day to personal Gmail accounts, with messages from the same primary domain counted together, to authenticate with SPF and DKIM and to publish a DMARC policy, which can start at p=none. Google describes those requirements as protection against spoofing and phishing, and they also decide whether messages are rejected or marked as spam.
The stakes rise for B2B senders, because many company inboxes sit behind filtering of their own. In our census of the Fortune 500, 276 of the 500 companies routed inbound mail through a secure email gateway visible in their MX records, and Proofpoint fronted 222 of those 276. Those gateways weigh sender authentication and reputation before a message reaches a buyer, so a domain weakened by spoofing is likely to be judged more strictly in exactly the inboxes B2B pipeline depends on.
Allegrow’s verification comes first, keeping bounces and spam-trap hits from your own sending off the domain. Behind that sits the protective layer: hourly SPF, DKIM and DMARC checks that flag a broken record before it fails legitimate mail, domain reputation monitoring across real B2B inboxes with daily spam and inbox placement tracking, and warm-up through real B2B inboxes for rebuilding placement after an incident.
How to stop email spoofing on your domain
Stopping email spoofing starts with establishing which systems are authorized to send email for your domain. The sections below walk through the practical sequence: publish SPF, configure DKIM, deploy DMARC, identify every service that sends as you, and extend protection beyond your main domain.
The sequence matters because organizations often have legitimate applications sending email that nobody remembered to authenticate. If you enforce DMARC before finding those senders, you can disrupt legitimate messages along with the spoofed ones.
Publish SPF
SPF lets a domain owner specify which hosts are authorized to send mail for the domain used in the SMTP envelope. Receiving systems can then compare the connecting server against that authorization.
That does not authenticate the visible From address by itself. SPF operates on the SMTP envelope identity, which is why DMARC alignment is needed to connect authentication with the address the recipient sees.
SPF also has a practical DNS limitation that frequently causes problems during implementation. The SPF evaluation process has a limit of 10 DNS-query-causing terms for mechanisms such as include, a, mx, and related lookups. Organizations that keep adding third-party services to one SPF record can therefore break authentication for legitimate mail if they exceed the limit.
Configure DKIM
DKIM adds a cryptographic signature to outgoing email. The sending system signs selected parts of the message, while the receiving system retrieves the corresponding public key from DNS and verifies the signature.
Its advantage is that authentication is tied to the message rather than simply to the connecting IP address. That makes DKIM useful in situations where mail passes through intermediate systems or forwarding paths that can interfere with SPF.
Deploy DMARC, starting in monitoring mode
DMARC connects the two systems above to the identity the recipient sees. It checks whether a message passes SPF or DKIM with the required alignment to the domain in the visible From address.
The usual progression is monitoring first, followed by quarantine and then reject once legitimate sending sources have been identified. Skipping the monitoring stage can cause legitimate applications to fail authentication and makes troubleshooting much harder.
The opposite failure is just as common. An organization publishes a monitoring policy, receives reports, and then leaves the domain there indefinitely. Monitoring gives you visibility. Enforcement is what turns that visibility into protection against exact-domain spoofing.
Find every service that sends as you
This is often the hardest part of email spoofing prevention. Your employees may not be the biggest source of legitimate email from your domain. Marketing platforms, CRMs, help desks, billing systems, recruiting software, customer-support systems, and other applications can all send messages on the company's behalf.
That makes third-party application email a significant authentication surface. Before enforcing DMARC, you need to know which systems legitimately send as your domain and make sure their authentication is configured correctly.
Extend protection beyond the main domain
Attackers can move to less-protected subdomains after the primary domain becomes difficult to spoof. Authentication therefore needs to be considered across the domains and subdomains that represent your organization, not just the address used by employees.
Lookalike domains require a separate control. SPF, DKIM, and DMARC cannot protect a domain that you do not own. Domain monitoring and registration controls are therefore complementary measures rather than replacements for email authentication.
What SPF, DKIM and DMARC cannot prevent
Email authentication is powerful, but it is easy to overstate what it does. SPF, DKIM, and DMARC are designed to verify whether a message is authorized to use a domain, not to determine whether the person behind the message is trustworthy. As a result, authentication can provide strong protection against certain types of domain spoofing while leaving other impersonation techniques untouched.
The remaining cases require controls outside SPF, DKIM, and DMARC. Recipient-side filtering can identify suspicious behavior, domain monitoring can identify lookalikes, and human verification can stop fraudulent payment changes.
That last layer is particularly important for BEC. In 2025, the FBI's IC3 received 24,768 BEC complaints associated with $3,046,598,558 in reported losses. The figures represent complaints reported to IC3, not the total amount of BEC occurring worldwide.
What to do if your domain is already being spoofed
Start by confirming what is actually happening. Investigate the headers of reported messages and review your DMARC aggregate data to determine whether unauthorized sources are sending messages that claim to represent your domain.
Next, make sure SPF, DKIM, and DMARC are correctly configured and move toward enforcement once legitimate sending sources have been identified. If customers, partners, or suppliers are likely to encounter the fraudulent messages, notify them through established communication channels and explain how to verify suspicious requests.
Preserve evidence as well. Keep copies of suspicious messages, relevant headers, authentication reports, domains used in impersonation, and information about affected recipients. If money, credentials, or other sensitive information is involved, report the incident through the appropriate national cybercrime or law-enforcement mechanism.
Recovery does not necessarily end when the spoofing stops. If unauthorized messages generated negative recipient signals, legitimate email may still need time and careful sending practices to recover its reputation and placement.
Conclusion
SPF, DKIM and DMARC are where stopping spoofing starts, and DMARC enforcement is what makes exact-domain impersonation hard. The rest of the problem, from lookalike domains to compromised supplier accounts, needs domain monitoring, account security and human verification of sensitive requests.
For businesses that depend on email, the problem also has a commercial side. A spoofing campaign can surface first as falling replies and weaker placement, and once it is contained, recovering the reputation it damaged depends on the same thing every campaign does: whether the contacts you email legitimately are valid and reachable.
Start a 14-day free trial and verify up to 1,000 of your own B2B contacts by CSV upload, with no integration or API needed. The trial returns conclusive valid or invalid results on catch-all contacts, detects spam traps, disposable addresses and inactive mailboxes, and identifies each contact’s primary email.
Frequently asked questions
Can I stop my email from being spoofed?
You can make exact-domain spoofing much harder to deliver by correctly configuring SPF and DKIM and enforcing DMARC. However, authentication does not stop display name impersonation, lookalike domains, or compromised legitimate accounts.
How do you know if an email is spoofed?
For an individual message, inspect its headers and check the SPF, DKIM, and DMARC results, the relationship between the Return-Path and visible From domain, and the Received chain. Also look for behavioral warning signs such as unexpected payment changes, unusual urgency, a mismatched Reply-To address, or a subtly altered domain.
Can a spoofed email be traced?
Headers can reveal useful information about the systems that handled a message, mostly through the Received chain. They cannot necessarily identify the attacker because infrastructure may be shared, intermediated, compromised, or intentionally obscured.
DMARC aggregate reports can also show sending sources associated with messages claiming to use your domain. They provide authentication and delivery-policy information rather than automatically identifying the person behind an attack.
What happens if you open a spoofed email?
Simply opening a suspicious email is usually less important than what you do afterward. The greater risks typically come from clicking malicious links, opening dangerous attachments, entering credentials, or acting on fraudulent instructions. If you open one, avoid interacting with its links or attachments and verify any request through a trusted channel.
What is the difference between email spoofing and phishing?
Email spoofing is the impersonation technique. Phishing is the broader attempt to deceive someone into taking an action or revealing information. A phishing message may use spoofing, but phishing can also use a lookalike domain, compromised account, malicious website, or other deceptive technique.
How much does email spoofing cost businesses?
There is no single global figure for email spoofing because many incidents go unreported and spoofing can support different types of fraud. The FBI's 2025 IC3 data recorded 24,768 Business Email Compromise complaints and $3.05 billion in reported losses, a figure that covers only complaints made to IC3.
Does DMARC stop all email spoofing?
No, DMARC can protect against exact-domain spoofing when enforcement is configured, but it does not stop lookalike domains, display name spoofing, or compromised legitimate accounts. It verifies domain authentication, not whether the person sending the message is trustworthy.
How do I test whether my domain is protected?
An email spoofing test should check whether your legitimate sending sources authenticate correctly, whether SPF and DKIM are configured, and whether they align with your visible From domain. You should also review DMARC reports to identify unauthorized sources and confirm that your policy is enforcing the protection you intend. You need to know which systems can send as your domain and what happens when an unauthorized source tries to do so.
.webp)
