Email spoofing is sending an email with a forged sender so that it looks like it came from someone else, such as a trusted company or a colleague. It is often used in phishing and business email compromise. Domain owners can make spoofing of their own domain much harder with SPF, DKIM and DMARC.
- Also Called2other namesSender spoofing · Spoofed email
- Related Terms3linked entriesDMARC, SPF and DKIM · Phishing
- Read Next1guide on the same topicPhishing 101
What is email spoofing?
NIST defines spoofing in general as an attempt to gain access to a system by posing as an authorized user, or the deliberate inducement of a user or resource to take incorrect action. Email spoofing applies that idea to the sender line of a message. The reader sees a name or address they trust, and acts on the message.
How does email spoofing work?
The attacker makes the visible sender look like a real person or organization. The RFC that defines DMARC explains the weak spot: SPF and DKIM can authenticate a domain, but senders had no standard way to tell receivers what to do with mail that fails, or to get reports back. That gap let spoofed mail claiming to come from legitimate domains reach inboxes. DMARC adds identifier alignment, which means the domain in the From address must match a domain validated by SPF or DKIM, or both.
| Question | Spoofed address | Lookalike domain |
|---|---|---|
| What the reader sees | The real domain of a trusted sender | An address that closely resembles a reputable one |
| How it is done | The sender line is forged | CISA: characters are altered or left out |
| What stops it | DMARC with a reject or quarantine policy | Domain monitoring and careful reading |
Why does it matter?
A message that appears to come from a known sender is more likely to be opened and trusted. That makes spoofing a common ingredient of phishing, spear phishing and business email compromise. It also harms the sender being imitated, because customers learn to distrust that brand, a theme covered in brand impersonation.
How can you tell if an email is spoofed?
CISA gives these tips for suspicious senders and messages.
- Check the sender addressLook for addresses that resemble a reputable company with characters altered or omitted.
- Verify independentlyContact the company using details from official sources, not from the message.
- Check linksHover over links to see that they match the text shown.
- Read the messageLook for poor grammar and generic greetings.
- Do not send sensitive dataNever answer an email asking for personal or financial information.
How can a domain owner prevent spoofing?
Publish a DMARC record. The RFC lets the domain owner ask receivers to take no action (none), treat failing mail as suspicious (quarantine) or refuse it (reject). It describes a path where owners strengthen the policy step by step, while reports show who sends mail in their name. Typosquatted and lookalike domains are not stopped by DMARC, so watch for those separately, see lookalike domain.
Also Called.
- NameSender spoofing
- NameSpoofed email
Questions.
-
What is email spoofing?
Sending an email with a forged sender so it appears to come from someone the reader trusts.
-
How can you tell if an email is spoofed?
CISA advises checking for sender addresses that resemble a real company with altered characters, verifying the sender through official contact details, checking that links match their text, and watching for poor grammar and generic greetings.
-
Does DMARC stop email spoofing?
DMARC lets a domain owner publish a policy of none, quarantine or reject for messages that fail authentication and alignment. It applies to mail that claims the owner's domain, not to lookalike domains.
-
Is email spoofing the same as phishing?
No. Spoofing is a technique for faking the sender. Phishing is the attempt to trick the reader, and it often uses spoofing.
Sources
In Our Research
- 1 The Board Meeting That Never Happened: Deepfake Video Calls and the New Wire Fraud August 2026
- 2 How Spear Phishing Campaigns Target C-Suite Executives: Tactics, Tools, and Defense July 2026
- 3 Lookalike Domains: How a Single Character Difference Becomes a Brand’s Worst Nightmare May 2026
- 4 Looking at Your Company Through the Eyes of an Attacker: What Is an Attacker’s-Eye View? March 2026
- 5 Browser Isolation: A Proactive Approach to Web Security June 2025
- 6 Leveraging Big Data Analytics for Enhanced Cyber Threat Detection August 2024