What Is Email Spoofing?

You get an email that looks like it came from your bank, your boss, or a service you use every day. The sender name is right, the address looks right, and it wants you to click a link or approve a payment. But the message never came from where it claims. This is email spoofing: forging the sender of a message so it appears to come from someone you trust. It is the engine behind most phishing, business fraud, and impersonation scams, and it works because the email system was never built to verify who a message is really from. This guide explains what email spoofing is, how it works, why it is so easy, the common forms it takes, how to spot a spoofed email, and how the modern defences — SPF, DKIM, and DMARC — actually stop it. It also covers where email aliases fit, so a forged message has far less to work with.

What email spoofing is

Email spoofing is the practice of forging the “From” information on an email so the message appears to come from a person or organisation it did not come from. The attacker sets the display name and the sender address to whatever they want — your bank, a colleague, a delivery company — and sends the message from their own infrastructure. Nothing about the underlying email is genuinely “from” the claimed sender; only the labels have been changed. Because almost everyone judges an email by the name at the top, that forged label is often all a scam needs to get a click. The technique is documented in detail on Wikipedia’s overview of email spoofing, and it has been part of the internet since email itself.

It helps to separate email spoofing from two things it is often confused with. It is not hacking: the attacker does not need access to the real sender’s account or mailbox to spoof it — they simply lie about who they are. And it is not the same as a compromised account, where a criminal genuinely sends from a real inbox they have broken into. Spoofing is pure forgery of identity at the envelope level. That distinction matters, because it means someone can spoof your address without ever touching your account, and you may only find out when the bounce-backs from a spam run start arriving.

How email spoofing works

To understand how email spoofing works, it helps to know that an email carries two different senders. There is the envelope sender (the “MAIL FROM” address used during delivery, sometimes called the return-path) and the header sender (the “From:” line your email client actually displays). These two do not have to match, and the header “From:” — the one you see — is just text the sending server writes. There is no built-in check that the server is allowed to use that address. An attacker connects to a mail server, or runs their own, and simply states that the message is from ceo@yourcompany.com. The receiving system, historically, took that claim at face value and delivered it.

A concrete example makes it clear. Imagine an attacker wants to reach an accounts-payable clerk. They rent a cheap server, connect to the company’s mail gateway, and announce that their message is from the chief financial officer’s real address. They write a short, plausible note — a supplier’s bank details have changed, please update them before the next payment run — and hit send. No password was stolen and no system was breached; the entire attack rests on the forged From line and the clerk’s trust in it. If the company has published no DMARC policy, that forged message can land in the inbox looking exactly like a genuine internal request.

The rest of the message is dressed to match. Attackers copy a brand’s logo, footer, and tone, register a link that redirects through a convincing-looking domain, and add urgency — a locked account, an overdue invoice, a package that cannot be delivered. When the forged “From:” line and the familiar design line up, the reader’s guard drops. This is why email spoofing is the delivery mechanism for so much phishing: the forgery gets the message opened and trusted, and the social engineering does the rest. The defences we cover below do not try to read the reader’s mind; they verify, at the technical level, whether the sending server was actually authorised to use that address.

Why email spoofing is so easy

Email spoofing is easy because the protocol that moves mail, SMTP, was designed in the early 1980s for a small, trusting network of researchers. Verifying identity was not a goal; delivering messages reliably was. As a result, SMTP lets the sending server declare any “From:” address, and for decades there was no standard way for the receiver to challenge it. The internet grew up around that trusting default, and spammers and fraudsters were quick to exploit it. Every anti-spoofing measure since has been a layer bolted on top of a protocol that assumes good faith.

The economics make it worse. Sending an email costs essentially nothing, so an attacker can spoof millions of messages for the price of a cheap server, knowing that even a fraction of a percent of clicks pays off. The tools are commoditised, too: ready-made kits and mailing scripts mean a would-be scammer needs little technical skill to start. That combination — a protocol that trusts by default and forgery that is nearly free — is why email spoofing remains one of the most common attack techniques on the internet despite being decades old. The good news is that the same standards that finally add verification are now widely deployed, and you can check for them yourself.

The stakes are not limited to junk in your inbox. The most expensive form of email spoofing is business email compromise, where an attacker forges a message from an executive or a supplier and asks an employee to wire money or change payment details. Because the request appears to come from a trusted colleague, these scams sail past technical filters and go straight for human judgement — and they cost organisations billions of dollars a year worldwide, according to law-enforcement reporting. A single convincing forged email, sent to the right person at the right moment, can do more damage than a mass run of a million messages. That asymmetry is exactly why authenticating your domain and training people to verify unusual requests both matter.

Common types of email spoofing

Not all email spoofing looks the same. Some forgeries change the address itself; others rely on the fact that most people only read the display name. Understanding the main variants makes each one easier to catch. The table below summarises the common forms, and the paragraphs that follow explain what to watch for.

Exact-domain email spoofing is the boldest form: the attacker puts your genuine domain in the “From:” line. This is exactly what SPF, DKIM, and DMARC are built to defeat, which is why a domain with those records properly configured is much harder to impersonate. Display-name spoofing is subtler and extremely common on mobile, where clients often show only the friendly name — the message reads as “Amazon Support” while the real address is a random string on a throwaway domain. Lookalike or “cousin” domains swap a character or add one (an extra letter, a number for a letter) so the address survives a quick glance. Reply-to spoofing leaves a plausible “From:” but quietly routes your reply to an attacker. And a truly compromised account is not spoofing at all — the mail is genuine — which is why authentication alone cannot catch everything and a sceptical eye still matters.

How to spot a spoofed email

You can catch a large share of email spoofing with a few habits, no technical tools required. The single most useful move is to check the actual sender address, not the display name. On a computer, hover over the name; on a phone, tap it to expand the full address. If the friendly name says one thing and the address behind it is a mismatch or a lookalike domain, treat the message as hostile. Look, too, at where links really go: hover to preview the destination before clicking, and be suspicious of any address that is not the plain, expected domain of the organisation.

• Read the full address, not the name. Expand the sender to see the real address behind the display name.
• Watch for urgency and threats. “Act now or your account is closed” is the oldest lever in the book.
• Hover before you click. If the link destination is not the plain expected domain, do not follow it.
• Check the reply-to. A reply that jumps to a different address is a classic spoofing tell.
• Verify out of band. If a message asks for money or credentials, confirm through a channel you already trust.

Be especially careful on your phone. Mobile mail apps are where display-name spoofing thrives, because most of them show only the friendly sender name and hide the underlying address until you tap it. A message that reads as a delivery company or a bank looks entirely legitimate at a glance, and the small screen and on-the-go context make people more likely to click without checking. Whenever a message on your phone pushes you to act, slow down and expand the sender before you do anything — those extra two seconds are the whole defence.

For a definitive check, open the message’s raw headers (most clients offer “show original” or “view source”) and look for the authentication results. Lines showing SPF, DKIM, or DMARC set to “fail” are strong evidence of email spoofing; “pass” on all three means the sending server was authorised to use that domain — though, as noted, it does not rule out a genuinely compromised account. If you regularly handle sensitive requests, learning to read those few header lines is one of the highest-value habits you can build. When something still feels off, the safest response is always to stop and verify the request through a separate, known-good channel rather than trusting the email in front of you.

How SPF, DKIM, and DMARC stop email spoofing

Three standards, working together, are what finally give receivers a way to reject forged mail — and they are the reason exact-domain email spoofing is much harder than it used to be. The first is Sender Policy Framework (SPF), a DNS record that lists the servers allowed to send mail for a domain. When a message arrives, the receiver checks whether the sending server is on that list; if not, SPF fails. The second is DomainKeys Identified Mail (DKIM), which adds a cryptographic signature to each message. The receiver verifies that signature against a public key in DNS, proving the message really came from the domain and was not altered in transit.

The third standard ties the first two together and tells receivers what to do when they fail. DMARC lets a domain owner publish a policy — monitor, quarantine, or reject — and requires that SPF or DKIM not only pass but “align” with the visible “From:” domain. With a DMARC policy set to reject, a message that forges your domain but cannot authenticate is refused outright, so it never reaches the inbox. This is precisely why sending your own domain’s mail through a service that enforces SPF, DKIM, and DMARC matters: it both protects your recipients from email spoofing that abuses your name and keeps your legitimate mail out of the spam folder. At EmailAlias we enforce all three on every domain and alias we handle, so forged mail claiming your alias domain fails authentication rather than landing in someone’s inbox.

Two honest caveats keep this in perspective. First, these standards protect the domains that deploy them; they cannot stop an attacker from spoofing a third party that has no DMARC policy, and plenty of small domains still do not. Second, authentication does nothing against display-name spoofing or lookalike domains, because those do not forge your actual domain at all — they only borrow your name or a similar one. That is why the technical layer and the human habits from the previous section are partners, not substitutes.

How email aliases limit spoofing damage

Email aliases do not stop the whole internet from forging addresses, but they meaningfully shrink what email spoofing can do to you. An alias is a separate forwarding address you hand out instead of your real inbox; mail to it forwards to you, and you can switch it off at any time. When you use a different alias for each service, a forged message that targets one of them is instantly more suspicious — a “your bank” phishing email arriving at the alias you only ever gave to a newsletter is obviously off. That context, which your real all-purpose address can never give you, turns many spoofing attempts into easy catches. You can read the mechanics in our guide to how email aliases work, and the broader idea in what is an email alias.

Aliases help on the other side of the problem, too. Because the address you give out is not your primary one, a data breach at a service leaks only a disposable-feeling alias — one you can retire — rather than the real inbox attackers would love to add to their spoofing and phishing lists. Keeping your true address off the open web with a private email alias means there is simply less raw material for forgery campaigns to target. And because these are permanent forwarding addresses you control — not disposable inboxes that expire — you keep the account, the receipts, and the recovery path while still being able to cut off any alias the moment it starts attracting hostile mail. If you are weighing when to hand out your real address at all, our piece on whether you should use your real email goes deeper.

Here is how that plays out in practice. Say you sign up for a shopping site with a dedicated alias and, months later, a message forging that retailer’s brand arrives asking you to confirm your card. Because you know that alias only ever belonged to one shop, an urgent security demand is immediately out of character — and if the retailer had a breach, you can retire that single alias without disturbing anything else you own. The forged message loses its two best weapons at once: the surprise of arriving at a trusted-looking address, and the leverage of threatening an account you cannot easily replace.

What to do if your address is being spoofed

Discovering that your own address is the one being forged is unsettling, and the first thing to know is that it usually does not mean you were hacked. In most email spoofing runs the attacker never touched your account — they simply wrote your address into the “From:” line of mail sent from their own servers. The tell-tale sign is a wave of bounce messages and angry replies for emails you never sent, sometimes called backscatter. Your inbox works normally; it is your name that is being borrowed. Confirm it by checking whether you can still log in normally and whether your sent folder is clean.

The durable fix is authentication on the domain being spoofed. If you own the domain, publish SPF, DKIM, and a DMARC policy — starting in monitor mode to see who is sending as you, then tightening to quarantine or reject once your legitimate senders pass. That is the single most effective step to stop others receiving forged mail in your name. If the spoofed address is on a domain you do not control, such as a free mail provider, report the abuse to that provider and to recipients who ask. Going forward, reduce your exposure: send from a domain with strong authentication, keep your primary address off public sign-up forms, and route new signups through an alias service so the address most exposed to breaches is never the one your reputation depends on. You can spin up your first addresses in a couple of minutes with an email alias generator, and see the plans on our pricing page.

Final thoughts

Email spoofing endures because it exploits the one thing email was never designed to guarantee: that a sender is who they claim to be. But the gap is no longer unmanaged. On the technical side, SPF, DKIM, and DMARC give domains a way to prove their mail is genuine and to have forgeries rejected before they reach anyone. On the human side, reading the real address, checking where links go, and verifying unusual requests out of band catch the forgeries that authentication cannot. And structurally, using a different alias for each service both makes a spoofed message stand out and keeps your real address out of the breach data that fuels these campaigns. Put those three layers together and email spoofing goes from a threat that routinely works to one that rarely gets past you. Start by giving your next signup its own alias instead of your real inbox — it is the easiest layer to adopt, and it pays off the first time a forged message lands somewhere it obviously should not.

Frequently asked questions