Email spoofing
Email spoofing is making a message appear to come from an address or domain that the sender is not authorized to use. A spoofed message may show a familiar name or address to encourage a recipient to trust it, but the visible sender information alone does not prove who sent the message.
How can a message appear to come from someone else?
Email contains several sender-related identities. The address shown in the From line is not necessarily the same identity that mail servers use to route or authenticate the message. An attacker may forge or misuse the visible author domain, or use a similar-looking address or display name. The recipient may see the familiar identity even when the message came from another system.
For example, a message that displays billing@example.com and asks Alex to pay an urgent invoice could be sent by an unauthorized system. Alex should not treat the displayed address, logo, or a successful authentication indicator as proof that the request is genuine. When a request is unexpected, verify it through a known contact method.
Can SPF, DKIM, and DMARC stop spoofing?
SPF and DKIM let receivers check different domain identities associated with mail. DMARC checks whether a passing SPF or DKIM domain matches the visible From domain under DMARC's rules and lets a domain owner express a handling preference. These controls can make direct impersonation of a protected domain harder, but they do not stop every lookalike domain, account taken over by an attacker, or deceptive message. A DMARC pass authenticates domain use under the checks; it does not certify the message's intent or content.