How to tell if an email is spoofed: who really sent it

An email is spoofed when the sender shown is not the sender who sent it. To tell, expand the sender to see the full address, look for the warning your mail app adds to unverified senders, and check the message's SPF, DKIM and DMARC results. A DMARC fail on the From domain means the address was forged.

That covers the classic forgery. It does not cover every trick, and this is where people get caught. There are four different ways to fake a sender, and each one is caught by a different check.

What counts as a spoofed email?

Kind of fake	What the attacker does	Example	What catches it
Forged address	Puts a real address they do not control in the From line	From: billing@yourbank.com, sent from a rented server	SPF, DKIM and DMARC fail. Gmail and Outlook show a "?"
Lookalike domain	Registers a near-copy of the real domain and sends from it properly	billing@yourbank-secure.com, rnicrosoft.com	Only reading the domain. Authentication passes
Display name only	Types a trusted name over an unrelated address	"PayPal Support" with a free webmail address	Expanding the sender to see the address
Real account, taken over	Sends from a genuine mailbox they broke into	Your colleague's actual address	Nothing technical. Verify by phone or another channel

Only the first row is spoofing in the strict sense, and it is the only one email authentication was built to stop. The other three pass every automated check, which is why "it passed DMARC" never means "it is safe".

Check 1: what your mail app already tells you

Before opening any headers, look at what the app shows. Both big providers flag senders they could not verify.

Gmail. Open the message and click the down arrow under the sender's name. According to Google's help page, a message is authenticated if you see a "mailed-by" line with the domain name and a "signed-by" line with the sending domain. A question mark next to the sender's name means the message is not authenticated, and Google's advice then is to be careful about replying or downloading attachments.

Gmail adds two more signals. The word "via" followed by another website next to the sender's name means the domain that sent the message does not match the domain in the From address. And a warning saying "This message may not have been sent by" a Gmail address appears when a message claims to be from someone@gmail.com but Google cannot confirm it came from that account.

Outlook. Microsoft's help page on suspicious messages describes two indicators. A "?" in the sender's picture means Outlook could not verify the sender's identity. An underlined "via" tag appears when the real sending address differs from the address in the From line. Microsoft adds a useful pattern: if a sender who normally has no "?" suddenly shows one, that could be a sign the sender is being impersonated.

Neither company treats these as proof. Google notes that real organizations sometimes fail authentication, for example on messages relayed through mailing lists. Read the indicators as "look closer", then do check 2.

Check 2: read the authentication results

When your provider receives a message, it runs three tests and writes the outcome into a header line called Authentication-Results.

SPF asks whether the server that delivered the message is on the list of servers the domain allows.
DKIM checks a cryptographic signature added by the sending domain, which also shows the message was not altered on the way.
DMARC ties them to what you see. It passes only when the domain in the From address is the same domain that passed SPF or DKIM. The standard calls this alignment, and it is defined in RFC 7489.

DMARC is the result to read first, because SPF and DKIM on their own can pass for a domain that has nothing to do with the From line.

To see the results on a real message:

In Gmail on a computer, open the email, click the three dots next to Reply and choose Show original. In Outlook on the web or the new Outlook, click the three dots at the top of the message, then View, then View message details.
Find the line that starts with Authentication-Results:. It looks like this:

Authentication-Results: mx.example.org;
   dkim=none;
   spf=fail smtp.mailfrom=billing@yourbank.example;
   dmarc=fail (p=REJECT) header.from=yourbank.example

Or copy the whole thing and paste it into the free Secria email header analyzer, which reads those lines for you in your browser. For the sample above it reports "SPF fail, DKIM none, DMARC fail. The From address may be forged."

How to read the outcome:

dmarc=fail: the From address was not verified. On a message that wants money, a login or an opened attachment, treat it as forged.
dmarc=pass: the message really came from the domain named after header.from=. Now read that domain letter by letter. When the same test message is sent from a lookalike domain with authentication set up correctly, the analyzer reports all three checks passing and says the sender domain "checks out". It does, for the lookalike. Whether that domain is your bank is a question only you can answer.
No DMARC result, or dmarc=none: the domain has not published a policy, so there is nothing to enforce. Fall back on SPF and DKIM and on check 3.

Check 3: where replies go and where it started

Two more header details expose fakes that pass authentication.

Reply-To. A message can show one address in From and send your reply to another. Real newsletters do this within their own domain. A message "from" your bank whose replies go to a free mailbox on another domain is a classic setup for collecting answers. The header analyzer lists Reply-To under sender details and marks it when the domain differs.

The first Received line. Each server that handles a message stamps a Received line on top, so the bottom one is closest to the origin. If a message claims to come from a large company and its trail begins at a home internet connection or an unrelated hosting company, that is worth weighing. Lines written before the message reached your provider can be invented by the sender, so use this as supporting evidence. The line your own provider added at the top is the one you can rely on.

Why did I get an email from my own address?

Usually because someone typed your address into the From line. That takes no access to your account. It is the forged-address row from the table, aimed at you, and it is a common opening for extortion emails that claim "I sent this from your account".

Two checks separate a forgery from a real break-in:

Look at the message's authentication results. If DMARC fails, or the mail did not come from your provider's servers, it was sent from elsewhere with your address pasted in.
Look at your account, not the email. Is the message in your Sent folder? Does your sign-in history show a device or location you do not recognize? In Gmail on a computer, click Details at the bottom right of the inbox to see recent account activity, including the last 10 IP addresses that accessed your mail.

If the Sent folder is clean and the activity is all yours, your account was not used. Report the message as phishing and delete it. If you do find sign-ins you do not recognize, change your password right away and review your account's security settings.

The same logic applies when friends say they got a strange email "from you". Ask one of them to forward it as an attachment or send you the original source, then run it through the checks above.

Why is spoofing still possible in 2026?

Email was designed without sender verification, and the fixes are opt-in for each domain. The pressure is rising: since February 1, 2024, Google has required anyone sending more than 5,000 messages a day to Gmail accounts to set up SPF, DKIM and DMARC. But the same page says the DMARC policy "can be set to none", which means the domain owner gets reports while forged mail is still delivered. A domain is only protected once its owner moves that policy to quarantine or reject.

Where senders go further, you get a visible reward. A blue checkmark next to a sender in Gmail means the sender has verified that it owns the email address and the brand logo, a check that builds on DMARC.

Frequently asked questions

Can a spoofed email pass SPF, DKIM and DMARC?

A forged From address on a domain with an enforced DMARC policy should fail. But a message from a lookalike domain, a message with only a faked display name, and a message from a hijacked real account all pass, because in each case the sending domain is telling the truth about itself. Passing authentication proves where a message came from. It does not prove who is behind that domain.

Does a failed check always mean the email is fake?

No. Google's help page says messages that are not authenticated are not necessarily spam, and that authentication sometimes breaks for real organizations, for example when mail goes through a mailing list or automatic forwarding. A fail is a reason to verify before you act, and a strong one when the message asks for money or credentials.

Can I find out who really sent a spoofed email?

You can usually find the server that handed the message to your provider and the domain that authenticated it. You can rarely identify the person. The IP address in the headers belongs to a mail server or a hosting company more often than to an individual. Tracing beyond that takes the provider's records, which is a job for law enforcement.

Someone is spoofing my email address. Can I stop it?

For a personal address at a large provider, you cannot stop others from typing it, but the provider's DMARC policy decides whether receivers accept the forgery. If you own the domain, publish SPF and DKIM records and move your DMARC policy to quarantine or reject. Headers also show whether mail between servers was encrypted, which we cover in our guide to checking if your email is encrypted.

Bottom line

Expand the sender, look for the question mark or the "via" tag, and read the DMARC result. A fail tells you the address is forged. A pass tells you to read the domain carefully and then decide. For mail that carries less of you with it, Secria Mail is free to start, encrypted, and removes tracking pixels automatically.