In short
Email spoofing is forging an email's From address so a message appears to come from a trusted person or domain. SPF, DKIM and DMARC at quarantine or reject stop criminals spoofing your exact domain. Lookalike domains and display-name impersonation need inbound protection such as spoof intelligence and impersonation checks in Microsoft 365, Gmail or a third-party layer.
Get a quote for email spoofing protection
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What is email spoofing?
Email was designed without built-in proof of who sent a message. The address shown in the From line is just text the sending server supplies, and the display name above it can be anything. Spoofing exploits that.
There are several related techniques, and they are stopped by different controls:
- Exact-domain spoofing: the From address uses your real domain, such as accounts@example.co.uk, sent from a server you do not control
- Display-name spoofing: a real person's name shown above an unrelated address, often a free webmail account
- Lookalike domains: a domain that resembles the real one, with a swapped or added character or a different ending, often set up with valid authentication so it passes checks
- Reply-to tricks: a believable From address with replies directed to the attacker
Strictly, only the first is spoofing; the others are impersonation. Both feed phishing, BEC attacks and invoice fraud.
Email spoofing vs impersonation vs phishing
These terms are often used interchangeably, but the distinction tells you which control to use.
| Technique | Example | Passes SPF, DKIM and DMARC? | What stops it |
|---|---|---|---|
| Exact-domain spoofing | Mail claiming to be from your domain, sent from an unauthorised server | No, if the domain owner enforces DMARC | DMARC at quarantine or reject on the spoofed domain, honoured by the receiver |
| Display-name impersonation | Your director's name on a free webmail address | Yes, for the webmail domain | Display-name and employee-name checks, external banners |
| Lookalike domain | A domain one character different from yours or a supplier's | Often yes, if the attacker set them up | Domain impersonation protection, lookalike detection |
| Compromised account | A real mailbox used by an attacker | Yes | Behavioural analysis, account takeover detection |
Phishing is the wider attack; spoofing and impersonation are ways to make it convincing.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Stopping criminals spoofing your domain
You control whether your own domain can be spoofed. Three DNS-published standards do the work:
- SPF lists the servers allowed to send mail for your domain; see SPF record
- DKIM adds a cryptographic signature that receivers can check against a public key in your DNS; see DKIM
- DMARC tells receivers what to do when a message fails those checks and sends you reports; see DMARC on our sister site
DMARC only stops spoofing once the policy moves from p=none to quarantine or reject, after every legitimate sender has been authenticated. Our guide to the DMARC policy not enabled warning covers that journey, and email authentication explains the full set, including MTA-STS and BIMI.
The NCSC retired its free Mail Check service on 31 March 2026, so organisations need their own DMARC reporting tool. Options we supply include Valimail, IRONSCALES DMARC, Sophos DMARC Manager and Check Point's DMARC Management add-on.
Third-party senders: the usual obstacle to enforcement
Most organisations send email from more places than they realise, and each one has to pass SPF or DKIM in line with your domain before DMARC can be enforced safely. Typical senders to find and authenticate include:
- Microsoft 365 or Google Workspace itself, including DKIM signing, which is not set up for custom domains until you enable it
- Marketing and newsletter platforms, CRMs and helpdesk tools
- Accounting, invoicing and payroll systems that email documents to customers and staff
- Websites, booking systems and forms that send notifications
- Scanners, printers and line-of-business applications that relay through your mail service
- A secure email gateway or encryption service that sends outbound mail on your behalf
DMARC aggregate reports show which of these are sending as your domain and whether they pass. Gmail, Outlook.com and Yahoo now expect authenticated mail from organisations that send in volume, as our guide to the Google bulk sender guidelines explains, so this work also protects deliverability.
Is email spoofing protection the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Detecting spoofed email you receive
Your DMARC policy protects your domain. To catch spoofing and impersonation of other domains, rely on inbound checks:
- Microsoft 365: spoof intelligence is on by default for all cloud mailboxes, and anti-phishing policies can honour the sender's DMARC policy. Unauthenticated sender indicators add a question mark to the sender's photo and a "via" tag when domains do not match. Defender for Office 365 adds user and domain impersonation protection and mailbox intelligence
- Google Workspace: advanced phishing and malware protection includes settings to protect against inbound emails spoofing your domain, similar domain names, spoofing of employee names and any unauthenticated email. Gmail shows a question mark next to the sender of unauthenticated mail
- Third-party layers: Acronis Email Security checks SPF, DKIM and DMARC as part of its anti-spoofing; Sophos Email checks them too; API products such as IRONSCALES, Check Point Email Security and FortiMail Workspace Security add impersonation and behavioural detection
See Microsoft 365 phishing protection and Gmail security settings for where these settings live.
How to check if an email is spoofed
When a message looks suspicious, these checks usually settle it:
- Look at the full sender address, not just the display name, and compare it with earlier genuine mail.
- Check whether the reply-to address differs from the sender.
- Look for warnings your mail service adds, such as a question mark on the sender, a "via" tag or an external-sender banner.
- Open the message headers and read the Authentication-Results line for the spf, dkim and dmarc results.
- If in doubt, contact the sender through details you already hold, and report the message using your organisation's process.
How we help
We can help you stop spoofing in both directions. We can:
- Check your SPF, DKIM and DMARC records and plan a safe path to enforcement
- Review spoof and impersonation settings in Microsoft 365 or Google Workspace
- Recommend, license and deploy a DMARC reporting service or an inbound protection layer, with contents confirmed at quote
Ask us for a quote: Contact us about stopping email spoofing.
How Forever Systems helps with email security
We are an independent UK IT and cyber security provider. We supply several email security platforms, so we can suggest what suits your mail system, your risks and your budget rather than pushing one product.
- Start with what you have: we can review the protection already built into Microsoft 365 or Google Workspace before suggesting anything extra
- Compare like for like: API-based protection, secure email gateways, encryption and DLP from the vendors we supply, explained in plain English
- Get authentication right: we help you plan SPF, DKIM, DMARC and MTA-STS so genuine mail is delivered and spoofed mail is not
- Deployment help: connecting a platform to Microsoft 365 or Google Workspace, mail routing changes and policy set-up, scoped at quote
- People and backup too: security awareness training, Check Point Harmony Email & Collaboration and Sophos from our specialist sites
Tell us about your mail system and we will suggest options, with pricing confirmed at quote.
Frequently asked questions
What is email spoofing?
Email spoofing is forging the sender details of an email so it appears to come from someone else, usually a trusted person, brand or domain. It is used to make phishing, business email compromise and invoice fraud more convincing.
What is the difference between email spoofing and phishing?
Spoofing is a technique for faking who a message is from. Phishing is the attack itself: trying to trick someone into clicking, signing in, paying or handing over data. Many phishing emails use spoofing or impersonation, but not all.
How do I stop someone spoofing my email domain?
Publish SPF and DKIM for every service that sends as your domain, then a DMARC record, and move the DMARC policy from p=none to quarantine and then reject once all legitimate mail passes. Use DMARC reports to find senders you have missed.
Why do spoofed emails still arrive when we have DMARC?
Your DMARC policy protects only your own exact domain. Lookalike domains, display-name impersonation and compromised accounts are not covered, and some senders do not enforce DMARC on their domains. Inbound impersonation protection covers those.
How can I tell if an email has been spoofed?
Check the full sender address and any reply-to address, look for warnings such as a question mark or "via" tag, and read the spf, dkim and dmarc results in the message headers. If in doubt, confirm with the sender through details you already hold.
Still have a question about email spoofing protection?
Ask us and a member of our team will reply by email.