Email Spoofing Explained: How to Stop It (2026)

Email spoofing is the forging of an email’s sender address so a message appears to come from someone it does not — your bank, your CEO, or your own domain. It is the technical foundation of most phishing and business email compromise, and because plain email was never designed to verify the sender, stopping it takes deliberate configuration. This guide explains what email spoofing is, how it works, and exactly how to stop email spoofing of your domain with the right authentication. It is part of our email security hub.

What is email spoofing?

So what is email spoofing, precisely? It is the practice of forging the sender information on an email so the recipient believes it came from a trusted source. Because the core email protocol (SMTP) lets a sender write almost anything in the From: header, an attacker can put your domain or name there without any password or access to your systems. The recipient sees a familiar name and trusts the message — which is exactly what the attacker wants. Email spoofing is not a breach of your servers; it is an abuse of email’s open design, and it is why a message that looks like it came from you may have nothing to do with you at all.

How email spoofing works

Spoofing exploits the gap between the parts of an email a human sees and the parts the mail system actually checks:

• Forged From header. The attacker simply sets the visible From: address to your domain. Nothing in basic SMTP stops them.
• Display-name spoofing. Even without forging the domain, they can set the display name to “Your Bank” while sending from a throwaway address — enough to fool a glancing reader.
• Lookalike domains. They register a domain that resembles yours (with a swapped or added character) and send from it.

The reason email spoofing succeeds is that, without authentication, a receiving server has no way to confirm that a message claiming to be from your domain was actually authorised by you. That is the gap email authentication closes.

How to stop email spoofing of your domain

You cannot stop attackers from typing your domain into a From field, but you can make receiving servers reject those forgeries. The defence is the email authentication stack, and the table below shows what each layer does:

The single most effective step to stop email spoofing is to deploy DMARC at an enforcement policy of p=reject. With DMARC at reject, any message that fails authentication for your domain — which is exactly what a spoofed message does — is refused by the receiving server before it reaches the inbox. SPF and DKIM are the prerequisites that make DMARC work, and BIMI adds a visible trust signal on top. The US Cybersecurity and Infrastructure Security Agency and every major mailbox provider recommend exactly this stack.

Email spoofing protection: a step-by-step plan

1. Publish SPF listing every legitimate sender, ending in -all or ~all.
2. Enable DKIM so your mail is cryptographically signed with your domain.
3. Publish DMARC at p=none with a reporting address, and review the reports to find every legitimate sender.
4. Move DMARC to p=quarantine then p=reject once you have confirmed your real mail passes.
5. Set a subdomain policy (sp=reject) so attackers cannot spoof news.yourdomain.com.
6. Consider BIMI to add your verified logo once you are at enforcement.

That sequence is complete email spoofing protection for your own domain. The whole process is covered in detail in our email authentication hub, and getting it right also improves your deliverability, since the same signals that prove you are legitimate also help you reach the inbox.

Spoofing, phishing and the bigger picture

Email spoofing is usually a means to an end: the end is phishing — tricking someone into revealing credentials, paying a fake invoice, or installing malware. Stopping spoofing of your domain protects your customers and partners from criminals impersonating you, which is both a security duty and a brand-protection measure. It does not, however, protect your own staff from inbound phishing sent from other spoofed or lookalike domains — that requires inbound filtering and user awareness. Domain authentication and inbound defence are two halves of a complete email security posture.

Why email spoofing is so damaging

It is worth being clear about the stakes, because email spoofing is not a victimless nuisance. When criminals forge your domain, the damage lands on three fronts at once. Your customers and partners are defrauded by messages that carry your name and your apparent authority — a fake invoice from “your” finance team, a password-reset lure on “your” letterhead — and the trust they lose is trust in you. Your brand suffers every time someone is scammed in your name, regardless of the fact that your own systems were never touched. And your deliverability takes a hit, because a flood of spoofed mail generating complaints and blocks can drag down the reputation of your sending domain, so your genuine email starts landing in spam.

That third consequence is the one senders most often overlook. Email authentication is usually framed as a deliverability measure, but it is equally a security measure, and the two are inseparable: the very same DMARC enforcement that stops a criminal spoofing your domain also tells mailbox providers that mail from your domain is trustworthy. Neglecting it leaves you exposed on both fronts simultaneously, which is why it should be one of the first things any organisation configures, not an afterthought once a problem appears.

Protecting your people from inbound spoofing

Authenticating your own domain stops others being fooled by mail forged in your name, but it does nothing to protect your own staff from spoofed mail sent by other domains. For that inbound risk you need a second set of defences. A secure email gateway or your provider’s built-in protection will check inbound mail against the sender’s SPF, DKIM and DMARC and quarantine messages that fail — which is precisely why the whole ecosystem deploying DMARC benefits everyone, since each authenticated domain becomes one that receivers can confidently reject forgeries of. Enabling strict DMARC checking on inbound mail, and treating display-name mismatches and lookalike domains as red flags, closes much of the remaining gap.

The human layer matters here too. Because display-name spoofing and lookalike domains do not forge your domain at all, no authentication check on your side will catch them — only a recipient who pauses to check the actual sending address will. Combining domain authentication, inbound filtering and basic user awareness gives you defence against both the spoofing of your domain and the spoofing aimed at your people. For the inbound social-engineering threat that spoofing enables, see our email phishing guide, and for the full configuration walk-through, the authentication hub.

How to check your spoofing protection is working

Deploying authentication is only half the job; you should verify that it actually protects you, because a misconfigured record gives a false sense of security. Start by confirming the records exist and are valid: look up your domain’s SPF, DKIM and DMARC records and check that the DMARC policy is at p=quarantine or p=reject rather than a monitoring-only p=none — a domain sitting at p=none is collecting reports but is not protected against spoofing. Our free email tools let you look up your SPF and DMARC records in seconds, and the DMARC aggregate reports you receive at your rua address show you exactly who is sending mail using your domain, including the spoofers your policy is now rejecting.

Those reports are the real proof. In the weeks after you reach enforcement, they reveal both the legitimate senders you may have missed and the volume of forged mail now being blocked on your behalf — turning an invisible threat into something you can measure. Make reviewing them a periodic habit rather than a one-off: new sending services get added over time, and a sending source that silently stops aligning can quietly reopen a gap. Treating spoofing protection as an ongoing posture, not a set-and-forget task, is what keeps your domain genuinely locked down. The complete configuration and monitoring workflow lives in our DMARC guide.

Check it yourself: use our free email tools to look up your domain’s SPF and DMARC records, and the header analyzer to inspect a suspicious message’s authentication results.

Related reading

• Email phishing protection
• Email encryption guide
• S/MIME email encryption guide
• PGP email encryption guide
• Best DMARC software

Email spoofing FAQ

How do I stop someone spoofing my email domain?

Publish SPF and DKIM, then deploy DMARC and move it to p=reject. A DMARC policy at reject tells receiving servers to refuse any message that fails authentication for your domain — which is what a spoofed message does. This is the single most effective anti-spoofing measure available.

Can email spoofing be completely prevented?

You cannot stop an attacker from typing your domain into a From field, but with DMARC at enforcement you can make receiving servers reject those forgeries before they reach inboxes. That neutralises domain spoofing in practice, though lookalike domains and display-name tricks still require user vigilance.

Is email spoofing the same as hacking my account?

No. Spoofing forges the sender address without any access to your account or servers — it abuses email’s open design rather than breaching your systems. If real mail is being sent from your account, that is a compromise; spoofing just makes mail look like it came from you.

Does SPF alone stop email spoofing?

No. SPF only checks the envelope sender, not the visible From: address a recipient sees, so a spoofer can pass SPF on their own domain while forging yours in the header. You need DMARC, which ties authentication to the visible From, to actually stop spoofing.

What is display-name spoofing?

Display-name spoofing sets the friendly name on an email (for example “IT Support”) to something trusted while sending from an unrelated address. Authentication on your domain does not stop it because the attacker is not forging your domain, so it relies on recipients checking the actual email address, not just the name — a habit worth teaching everyone, since mobile clients often hide the real address behind the display name by default.

Does stopping spoofing improve deliverability?

Yes. The SPF, DKIM and DMARC setup that stops spoofing is the same authentication mailbox providers require from legitimate senders, so deploying it both protects your domain and improves your inbox placement — a rare security measure that also helps your marketing reach. Since the 2024 bulk-sender requirements made DMARC effectively mandatory for senders above about 5,000 messages a day, the work you do to stop spoofing is now also the work you must do to keep reaching the inbox at all, so there is no longer any reason to treat the two as separate projects.