What is email spoofing?

Email spoofing is forging the sender details of an email so it appears to come from someone else, such as your bank, your boss or a service you use. It works because the core email protocol doesn’t verify who a message is from, so a sender can write any name and address into the From line. Spoofing is a common first step in phishing and payment fraud.

Also called: Spoofed email, Sender spoofing, Email address spoofing, From spoofing

Updated October 2026. Sources are numbered and listed at the end.

On this page

How email spoofing works

Every email carries two sender addresses. The envelope sender is what mail servers exchange behind the scenes and where bounces go. The From line is what your mail app shows you, and it can include a display name such as “Accounts team”. SMTP, the protocol that moves email between servers, checks neither. Its own standard calls SMTP mail “inherently insecure”, because anyone can talk to a mail server directly and create a message that seems to come from somewhere else.1 The From line is defined separately as the address of the message’s author, and nothing in that definition proves it.2

The common kinds of email spoofing.
KindWhat you seeWhat stops it
Exact domainThe real address of a real company, sent from a server that isn’t theirsDMARC with a quarantine or reject policy3
Display nameA trusted name, such as your manager’s, in front of an unrelated addressChecking the address itself, since DMARC doesn’t cover display names3
Lookalike domainAn address one letter off, such as yourbanc.com instead of yourbank.comReading the domain letter by letter, since DMARC doesn’t cover similar names3

Why email spoofing matters

A message that looks like it comes from someone you know gets trusted. CISA warns that a phishing sender’s address may imitate a legitimate business, often by changing or leaving out a few characters.4 The same trick drives business email compromise, where a fraudster poses as an executive or a supplier to get a payment sent. The FBI’s Internet Crime Complaint Center received 21,442 business email compromise complaints in 2024, with reported losses of about 2.77 billion dollars.5

How SPF, DKIM and DMARC stop it

Three DNS records let a domain prove which mail is really its own. Each one closes part of the gap.

  • SPF lists the servers allowed to send mail for a domain. It checks the envelope sender, not the From line you see.6
  • DKIM adds a digital signature to each message that names the signing domain, so a receiver can check the message came from that domain and wasn’t changed on the way.7
  • DMARC ties the two to the visible From line. A message passes only if SPF or DKIM passes for a domain that matches the From address, and the domain’s policy tells receivers to accept, quarantine or reject mail that fails.3

When a domain’s DMARC policy is reject, receivers that check DMARC are told to refuse mail that fakes that exact domain. Display names and lookalike domains are a separate problem, which is why it still pays to read the address itself.

How to spot a spoofed email

  • Look past the name. Open the sender details and read the full address, not just the display name.
  • Read the domain slowly. Swapped letters, extra words and odd endings are the giveaway of a lookalike.
  • Check where a reply would go. A Reply-To address that differs from the sender sends your answer somewhere else.2
  • Check the headers. The Authentication-Results line shows whether SPF, DKIM and DMARC passed or failed for that message.8
  • Confirm requests another way. For payments, bank detail changes or password resets, contact the person or company through a number or site you already trust.

Spoofing protection in Secria

The DMARC policy for secria.me is reject, with strict alignment for both SPF and DKIM, so receivers are told to refuse mail that only pretends to come from a Secria address. When you connect your own domain on Mail Plus or Secria Pro, Secria shows you the SPF, DKIM and DMARC records to add, each with a copy button, and checks them for you.

DMARCThe policy that tells receivers what to do with email that fails SPF and DKIM. SPFThe DNS record that lists which servers may send email for a domain. DKIMA digital signature on every email that shows which domain sent it. Email headerThe technical lines on top of every email that record its sender, route and checks. Email header analyzerPaste a message’s headers to see who really sent it and which checks passed.

Sources

  1. IETF, RFC 5321: Simple Mail Transfer Protocol, section 7.1 (October 2008).
  2. IETF, RFC 5322: Internet Message Format, section 3.6.2 (October 2008).
  3. IETF, RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC) (May 2026).
  4. CISA, Avoiding social engineering and phishing attacks.
  5. FBI Internet Crime Complaint Center, Internet Crime Report 2024.
  6. IETF, RFC 7208: Sender Policy Framework (SPF) (April 2014).
  7. IETF, RFC 6376: DomainKeys Identified Mail (DKIM) Signatures (September 2011).
  8. IETF, RFC 8601: Message Header Field for Indicating Message Authentication Status (May 2019).

Checked October 2026. Secria facts are from our Mail and VPN pages and the whitepaper.

Questions about email spoofing

Can someone send an email from my address?

Someone can put your address in the From line, but that doesn’t mean they got into your account. If the messages aren’t in your Sent folder, your account most likely wasn’t used. Changing your password and turning on two-factor sign-in is still a sensible step.

What is the difference between spoofing and phishing?

Spoofing is faking who a message is from. Phishing is the scam itself: getting you to click a link, pay or hand over details. A spoofed sender is one of the ways a phishing email makes itself believable.

How do I stop my domain from being spoofed?

Publish an SPF record, sign your mail with DKIM and publish a DMARC policy. Start DMARC at none to read the reports, then move to quarantine and finally reject once your real mail passes.

Does DMARC stop all spoofing?

No. DMARC stops mail that uses your exact domain in the From line. It doesn’t cover display names or lookalike domains, so those still need a careful look from the reader.

Email that’s ready for what comes next.

Post-quantum encryption on every plan, free included.

Start free

Explore Secria Mail