Email Spoofing
Updated
Email spoofing is the falsification of sender information to make a message appear to come from someone else. The deception may involve a display name, a visible From address, or another identity in the mail transaction. Different forms require different checks; a sender name alone is especially weak evidence.
What do I need to know about Email Spoofing?
- Compare the displayed name with the full address and consider whether the domain is the one you expected.
- SPF, DKIM, and DMARC answer different authentication questions. A pass is useful evidence, not a verdict that the message is harmless.
- A lookalike domain is a separate domain that resembles a trusted one. It may authenticate successfully under its own identity.
- A compromised mailbox can send genuine authenticated mail with fraudulent instructions. That is account abuse rather than simple header forgery.
An illustrative example
Two messages display “Finance Director.” One uses an unrelated address, while the other comes from the director’s real mailbox after an account takeover. A display-name check may expose the first. The second requires business-context checks and identity investigation. Treating both as a single authentication problem would miss the difference.
Practical checks
- Preserve the original message and inspect the sender, reply destination, and trusted authentication results.
- Compare any requested action with the usual business workflow and verify sensitive changes independently.
- Have administrators investigate exact-domain impersonation, lookalike domains, and account compromise as separate possibilities.
Five FAQs about Email Spoofing
Can someone spoof my address without knowing my password?
Yes. Forging sender information does not necessarily require mailbox access. That is why messages apparently sent by you are not, on their own, proof that your account was accessed.
Does DMARC stop all spoofing?
It helps receivers evaluate use of the visible From domain through aligned authentication. It does not stop every display-name deception, lookalike-domain message, or fraudulent email from a compromised account.
Why is Reply-To sometimes different from From?
Legitimate mailing platforms and support tools may use a different reply address. A mismatch deserves investigation when it redirects a sensitive conversation, but it is not automatically malicious.
Can an authenticated email still be phishing?
Yes. Authentication can establish something about a sending domain without establishing the sender’s intent, the safety of a link, or whether a payment request is authorized.
What should recipients do with a suspected spoof?
Use the organization’s reporting process and avoid interacting with its links or instructions. Preserve the original message so administrators can inspect headers and locate other copies.
Sources and further reading
Microsoft: How email authentication works · Proofpoint: Email spoofing
