Email Security

What is email spoofing?

Email spoofing is sending a message in which the sender shown on screen is not who actually sent it. Anyone, from any server in the world, can write your company's name and address in the sender field without breaking into anything, because the protocol that carries email was never designed to require proof of identity. It is the technical basis of phishing and executive impersonation fraud, and the reason SPF, DKIM and DMARC exist.

Zamak TechnologiesUpdated on August 6, 2026

How a spoofed email is put together

Every message carries two senders: the envelope sender, which servers use to move it, and the header sender, which is what the person actually sees. They do not have to match, and that gap is where spoofing lives.

Pick a name that opens doors

The criminal selects a domain the victim trusts: their own company, a supplier, a bank or a director's address. No access to any of them is required.

Type the sender by hand

The field shown as the sender is free text, filled in by whoever sends the message. Nothing in the sending process checks whether that address belongs to the sender.

Send it from any server

The message leaves infrastructure the criminal controls, often rented by the hour. The originating server has no relationship whatsoever with the spoofed domain.

The victim sees the name, not the path

Email clients display the display name prominently and hide the rest. On a phone the name is usually all that shows, and the real address sits two taps away.

Source: Microsoft's official documentation on email authentication, which describes the two sender identities every message carries (the envelope sender defined in RFC 5321 and the header sender defined in RFC 5322), and N-able University's email security material.

Why email has always allowed this

The email protocol was born without authentication. Microsoft's documentation puts it literally: by design, SMTP email on the internet makes no effort to validate that the message sender is who they claim to be. It was built for a small network where everyone knew each other.
There are two senders and only one gets checked. The envelope sender is what SPF verifies; the one the person reads on screen can be a different address, and that is precisely the one that persuades.
It is not a break-in, it is typing. Spoofing requires no password, no vulnerability and no access to the environment of the company whose name is being used. That is why it leaves no trace at all on the impersonated side.
With no published policy, the receiver is in the dark. If a domain does not state who may send on its behalf and what to do when the check fails, every provider decides on its own, and the forged message tends to get through.

The four ways to pass as your company

The exact domain The address shown is precisely your company's. This is pure spoofing, the kind DMARC blocks, and the only one a company can shut down on its own by publishing the right records: every provider that applies the published policy starts rejecting it.
A lookalike domain A real domain, registered by the criminal, that resembles yours by one swapped letter, an extra hyphen or a different ending. Because the criminal owns it, they publish flawless authentication and pass every check.
The display name The address can be anything, but the name shown is your CFO's or your company's. It works because phones show the name and hide the address.
A compromised real account Here nothing is forged: the message genuinely leaves the person's mailbox using stolen credentials. It passes every authentication check, which is why DNS records alone cannot stop it.

What is at stake when your name is used

90%

of malware is delivered by email, which makes the inbox the starting point of multi-stage attacks (N-able University, email security)

sender addresses exist in every message: the envelope one, which servers check, and the one shown on screen, which only gets checked once the domain publishes DMARC (RFC 5321 and RFC 5322)

75%

was the drop in unauthenticated messages received by Gmail users after authentication became a requirement (Google, 2023)

The damage from spoofing rarely falls on whoever received the message: it falls on the company whose name was used. A customer who pays a doctored invoice believing it came from their usual supplier goes after that supplier, not the criminal. An employee who wires money because the director asked by email turns the director's name into an instrument of fraud. And the cumulative effect is quieter: every forged message circulating in the domain's name erodes its reputation with the providers, until the company's legitimate email, the proposal and the invoice start landing in spam. That is why authentication stopped being a technical matter and became a market requirement: since 2024 at Gmail and since 2025 at Microsoft, anyone sending at high volume to those providers' personal mailboxes without authenticating simply is not delivered.

How to stop your domain from being spoofed

There is no switch that turns spoofing off, but there is a sequence that closes the door on the exact domain, which is the most dangerous form:

Inventory everything that sends as youBefore publishing any record, map everything that sends using the domain: corporate mail, the system that runs the business, the marketing platform, the invoicing system, the website form. A record published without that inventory takes legitimate email down with it.
Publish SPF and close the listDeclare in DNS which servers may send for the domain and end the list with the refusal instruction. The weak instruction, which merely flags the failure, is ignored by a good share of filters.
Sign your messages with DKIMThe cryptographic signature proves the message came from whoever controls the domain and that nobody altered the content along the way. It is what keeps authentication standing when a message is forwarded unchanged.
Publish DMARC and read the reportsDMARC is what ties the two previous records to the sender the person actually sees, and what returns a daily report of who has been sending in your domain's name. Start in monitoring, with the reports landing in a mailbox someone genuinely reads.
Move to blocking once the data allowsMonitoring is the middle of the road, not the destination. When the reports show every legitimate sender passing, move the policy to quarantine and then to reject. A domain parked in monitoring remains spoofable.

In practice

Spoofing your domain does not require breaking into your company, which is exactly why your antivirus and your firewall see nothing happening. The defense against spoofing does not live inside your environment: it lives in three records published in your domain's DNS, telling the entire world what to do with a message that claims to be yours and is not.

How Zamak handles email spoofing

Zamak Technologies treats domain authentication as measurement, not paperwork: inventory of every sender, publication in monitoring, reading of the reports, and promotion to blocking only with evidence that nothing legitimate is being lost, alongside the team that already looks after the domain rather than in its place. The email spoofing check shows, in seconds and with no sign-up, what your domain currently declares to the rest of the world. Keeping that posture under continuous watch is part of Managed Email Security and of Managed Cybersecurity in the Zamak Method.

Frequently asked questions about email spoofing

Someone spoofed my email. Does that mean I was hacked?

Most of the time, no. Spoofing the sender requires no access to your account, your network or your server: the message leaves the criminal's infrastructure with your name typed into the sender field. The exception is when messages genuinely leave your mailbox, with your folders and your signature, which does point to stolen credentials and calls for a password change and an access review.

Why did I get an email sent from my own address?

Because the sender field can be filled with any address, including yours. It is a common move in extortion scams, where the criminal writes your address in the sender field to suggest they control your account. If the domain publishes DMARC at blocking, that kind of message starts being rejected by the providers that apply the policy.

Do SPF, DKIM and DMARC solve it on their own?

They shut down exact-domain spoofing at every provider that applies the published policy, which is the most dangerous form, and that is a great deal. They do not solve lookalike domains or display name tricks, because in those cases the criminal uses their own domain with their own valid authentication. Those variations call for email filtering, people training, and verifying by another channel, a call to a number you already have, before any payment.

Does authentication also protect what arrives in my mailbox?

No, and this confusion is common. Domain authentication is an outbound control: it stops the world from being deceived with your name. What reaches you depends on your provider evaluating the sender's policy and on you having inbound filtering. They are two distinct layers, and one does not replace the other.

How long does it take to protect a domain?

Publishing the records takes minutes. What takes time is the measurement between publishing and blocking: usually a few weeks of reports until you are certain every legitimate sender has been mapped. Skipping that step is how a company takes down its own invoicing or its own email campaign.