{"id":291,"date":"2026-08-17T20:47:31","date_gmt":"2026-08-17T15:17:31","guid":{"rendered":"https:\/\/emailalias.io\/blog\/?p=291"},"modified":"2026-08-17T20:47:35","modified_gmt":"2026-08-17T15:17:35","slug":"what-is-email-spoofing","status":"publish","type":"post","link":"https:\/\/emailalias.io\/blog\/what-is-email-spoofing\/","title":{"rendered":"What Is Email Spoofing?"},"content":{"rendered":"\n<p>You get an email that looks like it came from your bank, your boss, or a service you use every day. The sender name is right, the address looks right, and it wants you to click a link or approve a payment. But the message never came from where it claims. This is <strong>email spoofing<\/strong>: forging the sender of a message so it appears to come from someone you trust. It is the engine behind most phishing, business fraud, and impersonation scams, and it works because the email system was never built to verify who a message is really from. This guide explains what email spoofing is, how it works, why it is so easy, the common forms it takes, how to spot a spoofed email, and how the modern defences \u2014 SPF, DKIM, and DMARC \u2014 actually stop it. It also covers where email aliases fit, so a forged message has far less to work with.<\/p>\n\n\n\n<nav class=\"post-toc\" aria-label=\"Table of contents\">\n  <h2 class=\"post-toc__title\">Table of contents<\/h2>\n  <ol class=\"post-toc__list\">\n    <li><a href=\"#what-email-spoofing-is\">What email spoofing is<\/a><\/li>\n    <li><a href=\"#how-email-spoofing-works\">How email spoofing works<\/a><\/li>\n    <li><a href=\"#why-email-spoofing-is-so-easy\">Why email spoofing is so easy<\/a><\/li>\n    <li><a href=\"#common-types-of-email-spoofing\">Common types of email spoofing<\/a><\/li>\n    <li><a href=\"#how-to-spot-a-spoofed-email\">How to spot a spoofed email<\/a><\/li>\n    <li><a href=\"#how-spf-dkim-and-dmarc-stop-email-spoofing\">How SPF, DKIM, and DMARC stop email spoofing<\/a><\/li>\n    <li><a href=\"#how-email-aliases-limit-spoofing-damage\">How email aliases limit spoofing damage<\/a><\/li>\n    <li><a href=\"#what-to-do-if-your-address-is-being-spoofed\">What to do if your address is being spoofed<\/a><\/li>\n    <li><a href=\"#final-thoughts\">Final thoughts<\/a><\/li>\n    <li><a href=\"#frequently-asked-questions\">Frequently asked questions<\/a><\/li>\n  <\/ol>\n<\/nav>\n\n\n\n<h2 class=\"wp-block-heading\">What email spoofing is<\/h2>\n\n\n\n<p>Email spoofing is the practice of forging the &#8220;From&#8221; information on an email so the message appears to come from a person or organisation it did not come from. The attacker sets the display name and the sender address to whatever they want \u2014 your bank, a colleague, a delivery company \u2014 and sends the message from their own infrastructure. Nothing about the underlying email is genuinely &#8220;from&#8221; the claimed sender; only the labels have been changed. Because almost everyone judges an email by the name at the top, that forged label is often all a scam needs to get a click. The technique is documented in detail on Wikipedia&#8217;s overview of <a href=\"https:\/\/en.wikipedia.org\/wiki\/Email_spoofing\" rel=\"noopener\" target=\"_blank\">email spoofing<\/a>, and it has been part of the internet since email itself.<\/p>\n\n\n\n<p>It helps to separate email spoofing from two things it is often confused with. It is not hacking: the attacker does not need access to the real sender&#8217;s account or mailbox to spoof it \u2014 they simply lie about who they are. And it is not the same as a compromised account, where a criminal genuinely sends from a real inbox they have broken into. Spoofing is pure forgery of identity at the envelope level. That distinction matters, because it means someone can spoof your address without ever touching your account, and you may only find out when the bounce-backs from a spam run start arriving.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How email spoofing works<\/h2>\n\n\n\n<p>To understand how email spoofing works, it helps to know that an email carries two different senders. There is the envelope sender (the &#8220;MAIL FROM&#8221; address used during delivery, sometimes called the return-path) and the header sender (the &#8220;From:&#8221; line your email client actually displays). These two do not have to match, and the header &#8220;From:&#8221; \u2014 the one you see \u2014 is just text the sending server writes. There is no built-in check that the server is allowed to use that address. An attacker connects to a mail server, or runs their own, and simply states that the message is from ceo@yourcompany.com. The receiving system, historically, took that claim at face value and delivered it.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-style-default\">\n  <img data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/08\/diagram-what-is-email-spoofing.jpg?resize=1080%2C567&#038;ssl=1\"\n       alt=\"How email spoofing works: an attacker sends a message whose displayed From address is forged to look like a trusted sender, while the real origin is hidden underneath\"\n       width=\"1080\" height=\"567\"\n       loading=\"lazy\" decoding=\"async\" \/>\n  <figcaption>Email spoofing forges the visible sender while the real origin stays hidden \u2014 authentication checks like SPF, DKIM, and DMARC exist to expose the mismatch before the message reaches you.<\/figcaption>\n<\/figure>\n\n\n\n<p>A concrete example makes it clear. Imagine an attacker wants to reach an accounts-payable clerk. They rent a cheap server, connect to the company&#8217;s mail gateway, and announce that their message is from the chief financial officer&#8217;s real address. They write a short, plausible note \u2014 a supplier&#8217;s bank details have changed, please update them before the next payment run \u2014 and hit send. No password was stolen and no system was breached; the entire attack rests on the forged From line and the clerk&#8217;s trust in it. If the company has published no DMARC policy, that forged message can land in the inbox looking exactly like a genuine internal request.<\/p>\n\n\n\n<p>The rest of the message is dressed to match. Attackers copy a brand&#8217;s logo, footer, and tone, register a link that redirects through a convincing-looking domain, and add urgency \u2014 a locked account, an overdue invoice, a package that cannot be delivered. When the forged &#8220;From:&#8221; line and the familiar design line up, the reader&#8217;s guard drops. This is why email spoofing is the delivery mechanism for so much <a href=\"https:\/\/en.wikipedia.org\/wiki\/Phishing\" rel=\"noopener\" target=\"_blank\">phishing<\/a>: the forgery gets the message opened and trusted, and the social engineering does the rest. The defences we cover below do not try to read the reader&#8217;s mind; they verify, at the technical level, whether the sending server was actually authorised to use that address.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why email spoofing is so easy<\/h2>\n\n\n\n<p>Email spoofing is easy because the protocol that moves mail, SMTP, was designed in the early 1980s for a small, trusting network of researchers. Verifying identity was not a goal; delivering messages reliably was. As a result, SMTP lets the sending server declare any &#8220;From:&#8221; address, and for decades there was no standard way for the receiver to challenge it. The internet grew up around that trusting default, and spammers and fraudsters were quick to exploit it. Every anti-spoofing measure since has been a layer bolted on top of a protocol that assumes good faith.<\/p>\n\n\n\n<p>The economics make it worse. Sending an email costs essentially nothing, so an attacker can spoof millions of messages for the price of a cheap server, knowing that even a fraction of a percent of clicks pays off. The tools are commoditised, too: ready-made kits and mailing scripts mean a would-be scammer needs little technical skill to start. That combination \u2014 a protocol that trusts by default and forgery that is nearly free \u2014 is why email spoofing remains one of the most common attack techniques on the internet despite being decades old. The good news is that the same standards that finally add verification are now widely deployed, and you can check for them yourself.<\/p>\n\n\n\n<p>The stakes are not limited to junk in your inbox. The most expensive form of email spoofing is business email compromise, where an attacker forges a message from an executive or a supplier and asks an employee to wire money or change payment details. Because the request appears to come from a trusted colleague, these scams sail past technical filters and go straight for human judgement \u2014 and they cost organisations billions of dollars a year worldwide, according to law-enforcement reporting. A single convincing forged email, sent to the right person at the right moment, can do more damage than a mass run of a million messages. That asymmetry is exactly why authenticating your domain and training people to verify unusual requests both matter.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Common types of email spoofing<\/h2>\n\n\n\n<p>Not all email spoofing looks the same. Some forgeries change the address itself; others rely on the fact that most people only read the display name. Understanding the main variants makes each one easier to catch. The table below summarises the common forms, and the paragraphs that follow explain what to watch for.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Type<\/th><th>How it works<\/th><th>The tell<\/th><\/tr><\/thead><tbody><tr><td>Exact-domain spoofing<\/td><td>Forges your real domain in the From line<\/td><td>Fails SPF, DKIM, or DMARC checks<\/td><\/tr><tr><td>Display-name spoofing<\/td><td>Real display name, unrelated actual address<\/td><td>The address behind the name is wrong<\/td><\/tr><tr><td>Lookalike (cousin) domain<\/td><td>Registers a near-identical domain<\/td><td>A swapped or added character in the domain<\/td><\/tr><tr><td>Reply-to spoofing<\/td><td>Legit-looking From, attacker-owned Reply-To<\/td><td>Replies go to a different address<\/td><\/tr><tr><td>Compromised account<\/td><td>Genuine mailbox the attacker controls<\/td><td>Passes auth, but the request is off<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>Exact-domain email spoofing is the boldest form: the attacker puts your genuine domain in the &#8220;From:&#8221; line. This is exactly what SPF, DKIM, and DMARC are built to defeat, which is why a domain with those records properly configured is much harder to impersonate. Display-name spoofing is subtler and extremely common on mobile, where clients often show only the friendly name \u2014 the message reads as &#8220;Amazon Support&#8221; while the real address is a random string on a throwaway domain. Lookalike or &#8220;cousin&#8221; domains swap a character or add one (an extra letter, a number for a letter) so the address survives a quick glance. Reply-to spoofing leaves a plausible &#8220;From:&#8221; but quietly routes your reply to an attacker. And a truly compromised account is not spoofing at all \u2014 the mail is genuine \u2014 which is why authentication alone cannot catch everything and a sceptical eye still matters.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to spot a spoofed email<\/h2>\n\n\n\n<p>You can catch a large share of email spoofing with a few habits, no technical tools required. The single most useful move is to check the actual sender address, not the display name. On a computer, hover over the name; on a phone, tap it to expand the full address. If the friendly name says one thing and the address behind it is a mismatch or a lookalike domain, treat the message as hostile. Look, too, at where links really go: hover to preview the destination before clicking, and be suspicious of any address that is not the plain, expected domain of the organisation.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Read the full address, not the name.<\/strong> Expand the sender to see the real address behind the display name.<\/li>\n\n\n\n<li><strong>Watch for urgency and threats.<\/strong> &#8220;Act now or your account is closed&#8221; is the oldest lever in the book.<\/li>\n\n\n\n<li><strong>Hover before you click.<\/strong> If the link destination is not the plain expected domain, do not follow it.<\/li>\n\n\n\n<li><strong>Check the reply-to.<\/strong> A reply that jumps to a different address is a classic spoofing tell.<\/li>\n\n\n\n<li><strong>Verify out of band.<\/strong> If a message asks for money or credentials, confirm through a channel you already trust.<\/li>\n<\/ul>\n\n\n\n<p>Be especially careful on your phone. Mobile mail apps are where display-name spoofing thrives, because most of them show only the friendly sender name and hide the underlying address until you tap it. A message that reads as a delivery company or a bank looks entirely legitimate at a glance, and the small screen and on-the-go context make people more likely to click without checking. Whenever a message on your phone pushes you to act, slow down and expand the sender before you do anything \u2014 those extra two seconds are the whole defence.<\/p>\n\n\n\n<p>For a definitive check, open the message&#8217;s raw headers (most clients offer &#8220;show original&#8221; or &#8220;view source&#8221;) and look for the authentication results. Lines showing SPF, DKIM, or DMARC set to &#8220;fail&#8221; are strong evidence of email spoofing; &#8220;pass&#8221; on all three means the sending server was authorised to use that domain \u2014 though, as noted, it does not rule out a genuinely compromised account. If you regularly handle sensitive requests, learning to read those few header lines is one of the highest-value habits you can build. When something still feels off, the safest response is always to stop and verify the request through a separate, known-good channel rather than trusting the email in front of you.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How SPF, DKIM, and DMARC stop email spoofing<\/h2>\n\n\n\n<p>Three standards, working together, are what finally give receivers a way to reject forged mail \u2014 and they are the reason exact-domain email spoofing is much harder than it used to be. The first is <a href=\"https:\/\/en.wikipedia.org\/wiki\/Sender_Policy_Framework\" rel=\"noopener\" target=\"_blank\">Sender Policy Framework<\/a> (SPF), a DNS record that lists the servers allowed to send mail for a domain. When a message arrives, the receiver checks whether the sending server is on that list; if not, SPF fails. The second is <a href=\"https:\/\/en.wikipedia.org\/wiki\/DomainKeys_Identified_Mail\" rel=\"noopener\" target=\"_blank\">DomainKeys Identified Mail<\/a> (DKIM), which adds a cryptographic signature to each message. The receiver verifies that signature against a public key in DNS, proving the message really came from the domain and was not altered in transit.<\/p>\n\n\n\n<p>The third standard ties the first two together and tells receivers what to do when they fail. <a href=\"https:\/\/en.wikipedia.org\/wiki\/DMARC\" rel=\"noopener\" target=\"_blank\">DMARC<\/a> lets a domain owner publish a policy \u2014 monitor, quarantine, or reject \u2014 and requires that SPF or DKIM not only pass but &#8220;align&#8221; with the visible &#8220;From:&#8221; domain. With a DMARC policy set to reject, a message that forges your domain but cannot authenticate is refused outright, so it never reaches the inbox. This is precisely why sending your own domain&#8217;s mail through a service that enforces SPF, DKIM, and DMARC matters: it both protects your recipients from email spoofing that abuses your name and keeps your legitimate mail out of the spam folder. At EmailAlias we enforce all three on every domain and alias we handle, so forged mail claiming your alias domain fails authentication rather than landing in someone&#8217;s inbox.<\/p>\n\n\n\n<p>Two honest caveats keep this in perspective. First, these standards protect the domains that deploy them; they cannot stop an attacker from spoofing a third party that has no DMARC policy, and plenty of small domains still do not. Second, authentication does nothing against display-name spoofing or lookalike domains, because those do not forge your actual domain at all \u2014 they only borrow your name or a similar one. That is why the technical layer and the human habits from the previous section are partners, not substitutes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How email aliases limit spoofing damage<\/h2>\n\n\n\n<p>Email aliases do not stop the whole internet from forging addresses, but they meaningfully shrink what email spoofing can do to you. An alias is a separate forwarding address you hand out instead of your real inbox; mail to it forwards to you, and you can switch it off at any time. When you use a different alias for each service, a forged message that targets one of them is instantly more suspicious \u2014 a &#8220;your bank&#8221; phishing email arriving at the alias you only ever gave to a newsletter is obviously off. That context, which your real all-purpose address can never give you, turns many spoofing attempts into easy catches. You can read the mechanics in our guide to <a href=\"https:\/\/emailalias.io\/blog\/how-email-aliases-work\/\" rel=\"noopener\" target=\"_blank\">how email aliases work<\/a>, and the broader idea in <a href=\"https:\/\/emailalias.io\/blog\/what-is-an-email-alias\/\" rel=\"noopener\" target=\"_blank\">what is an email alias<\/a>.<\/p>\n\n\n\n<p>Aliases help on the other side of the problem, too. Because the address you give out is not your primary one, a data breach at a service leaks only a disposable-feeling alias \u2014 one you can retire \u2014 rather than the real inbox attackers would love to add to their spoofing and phishing lists. Keeping your true address off the open web with a <a href=\"https:\/\/emailalias.io\/private-email-alias\/\" rel=\"noopener\" target=\"_blank\">private email alias<\/a> means there is simply less raw material for forgery campaigns to target. And because these are permanent forwarding addresses you control \u2014 <a href=\"https:\/\/emailalias.io\/not-disposable-email\/\" rel=\"noopener\" target=\"_blank\">not disposable inboxes<\/a> that expire \u2014 you keep the account, the receipts, and the recovery path while still being able to cut off any alias the moment it starts attracting hostile mail. If you are weighing when to hand out your real address at all, our piece on <a href=\"https:\/\/emailalias.io\/blog\/should-you-use-your-real-email\/\" rel=\"noopener\" target=\"_blank\">whether you should use your real email<\/a> goes deeper.<\/p>\n\n\n\n<p>Here is how that plays out in practice. Say you sign up for a shopping site with a dedicated alias and, months later, a message forging that retailer&#8217;s brand arrives asking you to confirm your card. Because you know that alias only ever belonged to one shop, an urgent security demand is immediately out of character \u2014 and if the retailer had a breach, you can retire that single alias without disturbing anything else you own. The forged message loses its two best weapons at once: the surprise of arriving at a trusted-looking address, and the leverage of threatening an account you cannot easily replace.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What to do if your address is being spoofed<\/h2>\n\n\n\n<p>Discovering that your own address is the one being forged is unsettling, and the first thing to know is that it usually does not mean you were hacked. In most email spoofing runs the attacker never touched your account \u2014 they simply wrote your address into the &#8220;From:&#8221; line of mail sent from their own servers. The tell-tale sign is a wave of bounce messages and angry replies for emails you never sent, sometimes called backscatter. Your inbox works normally; it is your name that is being borrowed. Confirm it by checking whether you can still log in normally and whether your sent folder is clean.<\/p>\n\n\n\n<p>The durable fix is authentication on the domain being spoofed. If you own the domain, publish SPF, DKIM, and a DMARC policy \u2014 starting in monitor mode to see who is sending as you, then tightening to quarantine or reject once your legitimate senders pass. That is the single most effective step to stop others receiving forged mail in your name. If the spoofed address is on a domain you do not control, such as a free mail provider, report the abuse to that provider and to recipients who ask. Going forward, reduce your exposure: send from a domain with strong authentication, keep your primary address off public sign-up forms, and route new signups through <a href=\"https:\/\/emailalias.io\/email-alias-service\/\" rel=\"noopener\" target=\"_blank\">an alias service<\/a> so the address most exposed to breaches is never the one your reputation depends on. You can spin up your first addresses in a couple of minutes with an <a href=\"https:\/\/emailalias.io\/email-alias-generator\/\" rel=\"noopener\" target=\"_blank\">email alias generator<\/a>, and see the plans on our <a href=\"https:\/\/emailalias.io\/pricing\/\" rel=\"noopener\" target=\"_blank\">pricing page<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Final thoughts<\/h2>\n\n\n\n<p>Email spoofing endures because it exploits the one thing email was never designed to guarantee: that a sender is who they claim to be. But the gap is no longer unmanaged. On the technical side, SPF, DKIM, and DMARC give domains a way to prove their mail is genuine and to have forgeries rejected before they reach anyone. On the human side, reading the real address, checking where links go, and verifying unusual requests out of band catch the forgeries that authentication cannot. And structurally, using a different alias for each service both makes a spoofed message stand out and keeps your real address out of the breach data that fuels these campaigns. Put those three layers together and email spoofing goes from a threat that routinely works to one that rarely gets past you. Start by giving your next signup its own alias instead of your real inbox \u2014 it is the easiest layer to adopt, and it pays off the first time a forged message lands somewhere it obviously should not.<\/p>\n\n\n\n<h2 id=\"frequently-asked-questions\">Frequently asked questions<\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-question-1786967981772\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What is email spoofing in simple terms?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Email spoofing is forging the sender information on an email so it looks like it came from a person or company it did not come from. The attacker sets the display name and the visible From address to whatever they want and sends the message from their own servers. Nothing about the message is genuinely from the claimed sender \u2014 only the label has been changed \u2014 which is why a forged From line is often all a scam needs to earn a click.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1786967991497\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Is email spoofing the same as hacking?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No. Hacking means breaking into an account or system; email spoofing just lies about who a message is from without touching the real sender&#8217;s mailbox at all. That is why someone can spoof your address while you can still log in normally and your sent folder stays clean. A genuinely compromised account, where a criminal sends from a mailbox they broke into, is a separate problem \u2014 the mail there is technically real, which is why authentication alone cannot catch every threat.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1786968004982\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">How can I tell if an email is spoofed?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Start by expanding the sender to read the actual address behind the display name \u2014 a friendly name with a mismatched or lookalike domain is a strong sign of spoofing. Hover over links to see where they really go, watch for urgency and threats, and check whether the reply-to jumps to a different address. For a definitive answer, open the raw message headers and look at the SPF, DKIM, and DMARC results; a fail on those is clear evidence the sender was not authorised.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1786968016082\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What stops email spoofing?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Three authentication standards do the heavy lifting: SPF lists which servers may send for a domain, DKIM cryptographically signs each message, and DMARC ties them together and tells receivers to reject mail that fails. With a DMARC policy set to reject, a message that forges a protected domain is refused before it reaches the inbox. These protect domains that deploy them, so they cannot stop spoofing of a third party with no DMARC policy, and they do not catch lookalike domains \u2014 human checks still matter.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1786968028081\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Can someone spoof my email address without my password?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Yes. Email spoofing does not require your password or any access to your account, because the visible From line is just text the sending server writes. An attacker can put your address in the From field of mail sent entirely from their own infrastructure. The usual sign is a wave of bounce messages for emails you never sent. The durable fix is publishing SPF, DKIM, and a DMARC policy on your domain so receivers reject forgeries sent in your name.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1786968042428\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Does SPF, DKIM, and DMARC completely stop spoofing?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>They stop exact-domain spoofing of the domains that deploy them, which is the boldest and most damaging form, but they are not a complete shield. They cannot protect a domain that has not published the records, and they do nothing against display-name spoofing or lookalike cousin domains, because those do not forge your real domain \u2014 they only borrow your name or a similar one. Authentication and human vigilance are partners: use both.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1786968055201\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">How do email aliases help against spoofing?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Aliases do not stop forgery across the internet, but they limit the damage. Using a different alias for each service means a spoofed message that arrives at the wrong alias is instantly suspicious \u2014 a bank phishing email landing on an alias you only gave to a newsletter is obviously fake. Aliases also keep your real address out of breach data that fuels spoofing campaigns, and because you can disable any alias in one click, you can cut off a sender the moment it turns hostile.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1786968064921\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What should I do if my email is being spoofed?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>First confirm you were not actually hacked: check that you can still log in and that your sent folder is clean \u2014 most spoofing never touches your account. Then, if you own the domain, publish SPF, DKIM, and a DMARC policy, starting in monitor mode and tightening to reject once legitimate senders pass. If the address is on a provider you do not control, report the abuse. Going forward, keep your primary address off public forms and route signups through aliases.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>You get an email that looks like it came from your bank, your boss, or a service you use every day. The sender name is right, the address looks right,&#8230;<\/p>\n","protected":false},"author":3,"featured_media":295,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[1],"tags":[],"class_list":{"0":"post-291","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-email-alias"},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/08\/og-what-is-email-spoofing.jpg?fit=1200%2C630&ssl=1","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":71,"url":"https:\/\/emailalias.io\/blog\/how-email-aliases-work\/","url_meta":{"origin":291,"position":0},"title":"How Email Aliases Work: A Simple 2026 Guide","author":"Troy Hunt","date":"May 23, 2026","format":false,"excerpt":"If you have ever wondered how email aliases work, the short answer is forwarding: an alias is a stand-in address that quietly relays every message to your real inbox without ever revealing it. But the full picture \u2014 how the address is created, how mail is routed, how replies stay\u2026","rel":"","context":"In &quot;Email Aliases&quot;","block_context":{"text":"Email Aliases","link":"https:\/\/emailalias.io\/blog\/category\/email-alias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-what-is-an-email-alias-1.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-what-is-an-email-alias-1.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-what-is-an-email-alias-1.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-what-is-an-email-alias-1.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-what-is-an-email-alias-1.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":163,"url":"https:\/\/emailalias.io\/blog\/secure-email-forwarding\/","url_meta":{"origin":291,"position":1},"title":"Secure Email Forwarding: How It Works and Why It Matters","author":"Troy Hunt","date":"June 13, 2026","format":false,"excerpt":"Secure email forwarding is the practice of relaying inbound messages through a privacy-aware service that hides your real address from the sender, encrypts the traffic in transit, validates message authenticity, and strips invasive trackers before the message reaches your real inbox. It is the missing layer between \"I gave a\u2026","rel":"","context":"In &quot;Privacy&quot;","block_context":{"text":"Privacy","link":"https:\/\/emailalias.io\/blog\/category\/privacy\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-secure-email-forwarding.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-secure-email-forwarding.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-secure-email-forwarding.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-secure-email-forwarding.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-secure-email-forwarding.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":176,"url":"https:\/\/emailalias.io\/blog\/private-email-forwarding\/","url_meta":{"origin":291,"position":2},"title":"Private Email Forwarding: How It Actually Works","author":"Troy Hunt","date":"June 16, 2026","format":false,"excerpt":"Private email forwarding lets you hand out an address that points at your real inbox without revealing what that real inbox is. Every message gets routed through a forwarding alias, so the sender only ever sees the alias \u2014 and if that alias starts attracting spam or shows up in\u2026","rel":"","context":"In &quot;Email Aliases&quot;","block_context":{"text":"Email Aliases","link":"https:\/\/emailalias.io\/blog\/category\/email-alias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-private-email-forwarding.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-private-email-forwarding.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-private-email-forwarding.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-private-email-forwarding.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-private-email-forwarding.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":47,"url":"https:\/\/emailalias.io\/blog\/what-is-an-email-alias\/","url_meta":{"origin":291,"position":3},"title":"What Is an Email Alias? Complete Guide for 2026","author":"Troy Hunt","date":"May 17, 2026","format":false,"excerpt":"An email alias is a forwarding address that hides your real inbox while still delivering every message you receive \u2014 newsletters, receipts, password resets \u2014 straight to the inbox you already use. Instead of handing out your primary address to every website, store, and signup form, you generate a separate\u2026","rel":"","context":"In &quot;Email Aliases&quot;","block_context":{"text":"Email Aliases","link":"https:\/\/emailalias.io\/blog\/category\/email-alias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-what-is-an-email-alias.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-what-is-an-email-alias.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-what-is-an-email-alias.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-what-is-an-email-alias.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-what-is-an-email-alias.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":80,"url":"https:\/\/emailalias.io\/blog\/how-to-stop-spam-emails\/","url_meta":{"origin":291,"position":4},"title":"How to Stop Spam Emails for Good: A 2026 Guide","author":"Troy Hunt","date":"May 27, 2026","format":false,"excerpt":"Wondering how to stop spam emails without spending another Saturday clicking \"unsubscribe\" on a hundred newsletters? The honest answer is that traditional filters are losing the arms race \u2014 spammers buy leaked lists faster than Gmail can update its rules. The reliable fix is structural: stop giving every site your\u2026","rel":"","context":"In &quot;Privacy&quot;","block_context":{"text":"Privacy","link":"https:\/\/emailalias.io\/blog\/category\/privacy\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-how-to-stop-spam-emails.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-how-to-stop-spam-emails.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-how-to-stop-spam-emails.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-how-to-stop-spam-emails.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-how-to-stop-spam-emails.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":313,"url":"https:\/\/emailalias.io\/blog\/what-is-a-tracking-pixel\/","url_meta":{"origin":291,"position":5},"title":"What Is a Tracking Pixel?","author":"Troy Hunt","date":"August 22, 2026","format":false,"excerpt":"You open a marketing email, read it for a moment, and move on. Without you clicking anything, the sender now knows you opened it, roughly when, on what kind of device, and often from where. The thing that told them is a tracking pixel: a tiny, usually invisible image \u2014\u2026","rel":"","context":"In &quot;Email Aliases&quot;","block_context":{"text":"Email Aliases","link":"https:\/\/emailalias.io\/blog\/category\/email-alias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/08\/og-what-is-a-tracking-pixel.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/08\/og-what-is-a-tracking-pixel.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/08\/og-what-is-a-tracking-pixel.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/08\/og-what-is-a-tracking-pixel.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/08\/og-what-is-a-tracking-pixel.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/posts\/291","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/comments?post=291"}],"version-history":[{"count":1,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/posts\/291\/revisions"}],"predecessor-version":[{"id":296,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/posts\/291\/revisions\/296"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/media\/295"}],"wp:attachment":[{"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/media?parent=291"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/categories?post=291"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/tags?post=291"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}