What is email spoofing in simple terms?

Faking the sender of an email so it looks like it comes from someone you trust, like your boss or a supplier. The underlying mail protocol does not verify senders by itself, so receivers must check using SPF, DKIM and DMARC.

Can spoofing be stopped completely?

Exact forgery of your own domain can be largely stopped with an enforced DMARC policy (p=quarantine or p=reject). Lookalike domains and display name spoofing cannot be stopped by DMARC and require detection on the receiving side.

How do I check if an email is spoofed?

Open the full headers and check the Authentication-Results line for SPF, DKIM and DMARC verdicts, and compare the Return-Path with the visible From address. Failing authentication for the claimed domain is a strong forgery signal.

What is the difference between spoofing and phishing?

Spoofing is the forgery technique; phishing is the attack that uses it. A phishing email typically spoofs a trusted sender to make its lure credible.

Does DMARC break legitimate email?

It can, if third-party services send as your domain without proper SPF/DKIM alignment. That is why rollout starts at p=none with report collection, so every legitimate sender is identified and fixed before enforcement.

What is Email Spoofing? Definition, examples and how to stop it

Email spoofing is the forging of email sender information so a message appears to come from someone the recipient trusts. It is the foundational technique behind phishing, business email compromise and whaling: the fraud only works if the sender looks right.

Key facts:

The original email protocol (SMTP) does not verify senders; anyone can put any address in the From field unless the receiving side checks.
Three DNS standards close the gap: SPF, DKIM and DMARC. Spoofing of your exact domain is largely preventable with a correctly enforced DMARC policy.
Attackers therefore shift to lookalike domains and display name tricks, which DMARC does not cover and which require behavioral detection.

The three types of sender forgery

This table is the most important thing to understand about spoofing: perfect SPF/DKIM/DMARC hygiene eliminates only the first row. The other two rows are how most modern impersonation actually arrives, often paired with pretexting to complete the deception.

How to spot a spoofed email in the headers

Every email carries full headers (in Gmail: "Show original"; in Outlook: "View message source"). Three things to check: the Return-Path (does it match the visible From domain?), the Received chain (did the message originate from a plausible server?), and the Authentication-Results line, which shows whether SPF, DKIM and DMARC passed. A message claiming to be from your CEO that fails DMARC, or passes it for a completely different domain, is forged.

Configuring SPF, DKIM and DMARC

SPF lists which servers may send for your domain, as a DNS TXT record:

v=spf1 include:_spf.google.com -all (Google Workspace)

v=spf1 include:spf.protection.outlook.com -all (Microsoft 365)

DKIM cryptographically signs outgoing mail. Enable it in Google Admin (Apps > Google Workspace > Gmail > Authenticate email) or in Microsoft Defender/Exchange admin, then publish the generated key in DNS. Use 2048-bit keys.

DMARC tells receivers what to do when SPF/DKIM fail for your domain, and sends you reports:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourcompany.com; pct=100 Roll out in stages: start at p=none to collect reports without affecting delivery, review which legitimate services fail (newsletters, CRMs, billing tools often send as your domain), fix their SPF/DKIM alignment, then move to p=quarantine and finally p=reject. Stopping at p=none, which many organizations do, provides monitoring but zero protection.

What SPF/DKIM/DMARC cannot do

Authentication protects your domain from being forged toward others who check it. It does not stop lookalike domains, display name tricks, or mail from genuinely compromised accounts at your vendors, where every technical check passes because the mailbox is real. Those attacks are caught behaviorally: sender history, relationship patterns and intent analysis.

How Sentaro stops spoofing

Sentaro verifies authentication signals and goes where DMARC cannot: its Message Defense vector detects newly registered lookalike domains and impersonation patterns, while Behavioral Defense flags messages that break an established relationship's normal, including display name abuse and compromised vendor accounts mid-thread.

Email Spoofing