Email spoofing is sending mail with a falsified sender, most often a fake From header, so it looks like it came from someone else. Spoofing is a technique; phishing is the scam that often uses it.
Why it matters
The original SMTP protocol never checked identity, so anyone can type any From address. Attackers use this to impersonate executives, banks or your own domain. Authentication standards reduce it: SPF lists permitted sending servers, DKIM signs messages and DMARC tells receivers to reject mail that fails both with alignment. Spoofing is not the same as a compromised account: with an account takeover the mail genuinely comes from your servers and passes all checks.
Example
A spoofed message:
From: "CEO Name" <ceo@example.com>
Return-Path: <x@bulk-sender.test>
Authentication-Results: spf=fail; dkim=none; dmarc=fail (p=reject)Because example.com publishes p=reject, a DMARC-aware receiver discards it. Without a DMARC policy, the same forgery would likely reach the inbox.
Common misconceptions
- Spoofing means the attacker hacked the account; usually they never touched it.
- SPF alone prevents it; SPF does not check the visible From address.
- Lookalike domains such as
examp1e.comare spoofing; they are distinct domains and DMARC cannot stop them.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.