What Email Spoofing Is, With an Example
Email spoofing means the visible sender is forged. The attacker never needs your password. They only need mail software that lets them type any address in the From header.
A finance example: the message says it is from ceo@yourcompany.com and asks accounts to pay a vendor today. Nothing on your server sent it. Your domain name was only quoted.
- Your mailbox, password and Sent folder stay untouched.
- The same trick aimed at customers uses your brand as the bait.
- A display-name trick is separate: the name reads like your director while the real address sits on another domain. A phone often shows only the name.
- SPF, DKIM and DMARC, below, are what tell other servers to drop a forgery of your real domain.
Why a Forged From Address Still Gets Delivered
Forged mail gets delivered because SMTP, the protocol that hands a message from server to server, was built to route mail, not to prove identity. The sending server states a From address and the next server accepts it.
Two addresses travel with every message. The header From is what the recipient sees. The SMTP envelope is what servers use to route and to bounce. They do not have to match. A Reply-To can point at the attacker while the From still shows your company.
Each hop adds a Received line with the server that passed the message on. That trail is how you later tell a forgery from mail that really left your host. The protocol itself is what an SMTP server is.
How Email Spoofing Differs from Phishing
Email spoofing is the disguise: a forged sender. Phishing is the job inside the message, which is to steal a password, a payment, or a click. A phishing email may use spoofing. Spoofing can also be a message that only wants the name to be trusted.
A lookalike domain is not spoofing. An address on a name the attacker registered, such as yourcompany-pay.com, is a different domain. True spoofing shows your real domain in the From header. DMARC on your domain can reject that case. It cannot reject a lookalike.
- Spoofing forges the header and shows your real domain. No login is required.
- A lookalike is a new domain that resembles yours. Your DMARC record does not stop it.
- Phishing is the request in the message: a password, a payment, or a file.
- A payment request that uses a trusted name still needs a check on a channel you already use.
Spoofed Email vs a Hacked Mailbox
A spoof uses your address. A hack uses your account. The response is different, so read the header before you reset every password.
| Question | Spoofed address | Hacked mailbox |
|---|---|---|
| Did they log in? | No | Yes |
| Is the message in Sent? | No | Usually yes |
| Does DMARC pass? | Often fails | Passes, because it left your server |
| First move | Fix the DNS records | Change the password, revoke sessions, and check forwarding |
Mail that left your real server and passed DMARC is the harder case. Receivers trust it because the signature is real. Two-factor authentication on the mailbox matters as much as the DNS records.
How SPF, DKIM and DMARC Stop Email Spoofing
Three DNS records tell receiving servers who may send as your domain, and what to do when a message fails that test.
| Record | What the receiver checks | If it fails |
|---|---|---|
| SPF | The sending server is on the domain's allow list | That server is not allowed for the envelope domain |
| DKIM | The signature matches the public key in DNS | The message was not signed by that domain, or it changed in transit |
| DMARC | The visible From domain aligns with SPF or DKIM, then the policy applies | The receiver monitors, quarantines, or rejects, as you published |
SPF checks the sending server, and forwarding can break it because the forwarder's address is not on your list. DKIM still verifies when the signature matches. DMARC requires the visible From domain to align with a domain that passed SPF or DKIM.
The policies are p=none (monitor only), p=quarantine (spam folder) and p=reject (discard). Reports list who tried to send as you, including a form or a newsletter you forgot. A mailbox on business email hosting is quoted by email before you pay. The business email setup guide shows where the three records sit.
How to Check Whether Your Domain Can Be Spoofed
Your domain is easy to spoof when the TXT records have no SPF, an SPF record that ends in +all, or no DMARC policy that tells receivers to quarantine or reject a failure.
- Look up the TXT records on the domain. An SPF record starts with v=spf1. If it is missing, or it ends in +all, receivers are told that any server may send.
- Look up the TXT record at _dmarc on your domain. No record, or a record with p=none, means receivers are not told to reject forgeries. p=quarantine and p=reject are the policies that act.
- Open a message that claims to be from you and view the full header. Authentication-Results shows spf, dkim and dmarc as pass or fail. Received lines that are not your mail host mean the message did not leave your server.
- If mail you really sent fails SPF, a missing sender is the usual cause, such as a website form or a newsletter. Add that sender before you move DMARC from p=none to p=reject.
Do not send a test forgery to a customer to find out. Read your own DNS, and read the header of a message you already received.
Why Bounce Messages Arrive for Mail You Never Sent
Those bounces are called backscatter. Someone forged your address, the other server refused the message, and the failure notice came to you.
The bounce does not mean your mailbox sent the mail, and it does not mean your password leaked. Open the original message inside the notice. If the sending server is not yours, you were spoofed.
A flood of bounces can get the domain listed. After your real senders pass, a DMARC policy of p=reject cuts how many forgeries other servers accept, which cuts the notices. If a notice already names a blacklist, start with an email blacklist check rather than a password reset.
A Business Checklist Against Email Spoofing
Work through this list once, then again after you add any tool that sends mail as your domain.
- Publish one SPF record that names every real sender, and do not leave it on +all.
- Turn on DKIM signing at the server that actually sends the mail.
- Start DMARC at p=none, read the reports, then move to p=quarantine or p=reject.
- Treat an unexpected payment or password request as untrusted until you confirm it on a number or a ticket you already use.
- Turn on two-factor authentication so a stolen password cannot send mail that passes DMARC.
- Read the full address. A phone often hides the real domain behind the display name.
WebJi® reads support@webji.services at all hours, in Hindi and English, and the average first reply is under 60 minutes. The office phone is not a support line. A new mailbox is quoted by email before you pay.
Questions About Email Spoofing
What is email spoofing?
Email spoofing is a message whose From address was typed by someone else, so it appears to come from a person or company the recipient trusts. The attacker does not need that mailbox password. SMTP accepts the address the sending software claims.
How do scammers send email that looks like mine?
They use their own mail software and put your address in the From header. Your server never sees the message, and it will not appear in your Sent folder. A receiver that follows a DMARC reject policy drops it before the inbox.
Is email spoofing the same as phishing?
No. Spoofing is the forged sender. Phishing is the attempt to steal a password, a payment, or a click. One phishing message might use a forged From, a lookalike domain, or a mailbox that was actually hacked.
Is spoofing the same as my mailbox being hacked?
No. Spoofing leaves the mailbox alone and usually fails DMARC. A hack means someone logged in, so the mail they send can pass DMARC and will show in Sent. Change the password only after the header shows your own server.
How do SPF, DKIM and DMARC stop spoofing?
SPF lists the servers allowed to send for the domain. DKIM signs the message so a change in transit fails. DMARC requires the visible From domain to match one of those passes, then tells receivers to monitor, quarantine, or reject the rest.
How do I know if an email is spoofed?
Open the full header and read Authentication-Results. A fail on SPF, DKIM and DMARC, plus Received lines that are not your mail host, means the From address was forged. A familiar display name is not proof.
Can I stop my domain from being spoofed?
You can stop most forgeries of your exact domain with SPF, DKIM, and a DMARC policy of p=reject once legitimate mail passes. You cannot stop a lookalike domain, or a display name that only resembles you, with those records.
Why am I getting bounces for mail I never sent?
Someone forged your address, the other server refused the message, and the failure notice came back to you. That is backscatter, not proof you sent it. Move DMARC to p=reject after your real senders pass.
Is email spoofing illegal in India?
Cheating a person by pretending to be someone else, through a computer or a communication device, is an offence under section 66D of the Information Technology Act, 2000. The Act allows imprisonment up to three years and a fine up to one lakh rupees. Testing a domain you control, with no victim, is a different act.
Can email spoofing be traced?
Received headers name the servers that handled the message, often a compromised host or a bulk sender, not a street address. DMARC reports show which servers tried to send as your domain. Naming a person usually needs that server's operator.