What Is Email Spoofing?
Email spoofing is the practice of sending emails with a forged sender address. An attacker can make an email appear to come from your domain, your CEO's email address, or any other address they choose. The recipient sees a familiar, trusted sender and is more likely to open the email, click links, or follow instructions.
This is possible because the original email protocol (SMTP) was designed in an era when trust was assumed. SMTP has no built-in mechanism to verify that the sender address is legitimate. Without additional authentication measures, anyone with basic technical knowledge can send an email that appears to come from any address.
Why Email Spoofing Is Dangerous
Email spoofing enables a wide range of attacks:
- Phishing campaigns that appear to come from your organization, targeting your customers, partners, or employees
- Business email compromise where attackers impersonate executives to authorize fraudulent payments
- Brand damage when recipients receive spam or malicious emails that appear to originate from your domain
- Loss of trust as customers and partners question whether your communications are genuine
- Deliverability problems when your domain's reputation suffers because receiving servers associate it with spam
If your domain is being spoofed, you might not even know it until customers complain about suspicious emails or your legitimate emails start landing in spam folders.
How Attackers Forge Email Addresses
Understanding the mechanics helps appreciate why authentication is necessary. An email has two types of sender information:
- Envelope sender (MAIL FROM) -- The address used in the SMTP transaction, similar to the return address on a physical envelope. This is what the receiving mail server sees during delivery.
- Header From -- The address displayed to the recipient in their email client. This is what the human sees.
An attacker can set both of these to any value they choose. When you receive an email that appears to come from ceo@yourcompany.com, neither you nor your email client can tell whether it actually originated from your company's mail server unless authentication protocols are in place.
The Three Pillars of Email Authentication
Three complementary protocols work together to prevent email spoofing: SPF, DKIM, and DMARC. Each addresses a different aspect of the problem, and all three should be implemented for comprehensive protection.
SPF (Sender Policy Framework)
SPF allows you to specify which mail servers are authorized to send email on behalf of your domain. You publish a DNS TXT record listing the IP addresses and hostnames of your legitimate mail servers. When a receiving server gets an email claiming to be from your domain, it checks your SPF record to see if the sending server's IP address is authorized.
An SPF record looks something like this:
v=spf1 ip4:203.0.113.0/24 include:_spf.google.com -allThis record says: "Emails from my domain should only come from the IP range 203.0.113.0/24 or from Google's mail servers. Reject everything else."
Key points about SPF:
- SPF validates the envelope sender (MAIL FROM), not the header From that the recipient sees
- SPF has a 10-DNS-lookup limit, which can be exceeded with complex configurations
- SPF alone is not sufficient because it does not protect the header From address
DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic signature to outgoing emails. Your mail server signs each message with a private key, and the corresponding public key is published in your DNS records. The receiving server retrieves the public key and uses it to verify the signature, confirming that the email was authorized by your domain and has not been modified in transit.
A DKIM signature is added as an email header:
DKIM-Signature: v=1; a=rsa-sha256; d=yourdomain.com; s=selector1;chr(10)h=from:to:subject:date; bh=...; b=...Key points about DKIM:
- DKIM verifies both the sender's identity and message integrity
- It survives email forwarding better than SPF
- Multiple DKIM signatures can exist for different sending services
- Keys should be rotated periodically for security
DMARC (Domain-based Message Authentication, Reporting & Conformance)
DMARC ties SPF and DKIM together and tells receiving servers what to do when authentication fails. It also provides a reporting mechanism so you can monitor who is sending email using your domain.
A DMARC record specifies your policy:
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; pct=100;DMARC policies:
- p=none -- Monitor only. No action is taken on failing emails, but you receive reports. Start here.
- p=quarantine -- Failing emails are sent to the spam folder.
- p=reject -- Failing emails are rejected entirely. This is the strongest protection.
The critical function of DMARC is that it validates the header From address -- the one the recipient actually sees. It requires that either SPF or DKIM passes and that the authenticated domain aligns with the header From domain. This closes the gap that SPF and DKIM leave individually.
How to Check If Your Email Is Being Spoofed
There are several ways to determine if your domain is being spoofed:
- Check your DMARC reports. If you have DMARC set up with reporting enabled, the aggregate reports will show you all the servers sending email using your domain, including unauthorized ones.
- Search for bounce-backs. If you receive delivery failure notifications for emails you did not send, someone may be spoofing your address.
- Ask your recipients. If customers or partners report receiving suspicious emails from your address, investigate immediately.
- Use online tools. Services like MXToolbox, DMARC Analyzer, or Google Postmaster Tools can help you analyze your domain's email authentication status.
Setting Up DMARC: A Step-by-Step Approach
Implementing DMARC should be done gradually to avoid disrupting legitimate email delivery:
Step 1: Inventory Your Email Sources
Before setting any policies, identify every service and server that sends email on behalf of your domain. This includes your primary mail server, marketing platforms, CRM systems, transactional email services, help desk software, and any other system that sends email as your domain.
Step 2: Configure SPF
Create or update your SPF record to include all legitimate sending sources. Test it using online SPF validators to ensure it passes for your known sources and does not exceed the 10-lookup limit.
Step 3: Configure DKIM
Set up DKIM signing on all your legitimate mail servers and services. Each service will provide you with a public key to publish in your DNS. Verify that signatures are valid using email header analysis tools.
Step 4: Start DMARC with Monitoring
Publish a DMARC record with p=none to begin collecting reports without affecting email delivery:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com;Step 5: Analyze Reports and Fix Issues
Review your DMARC reports for two to four weeks. Identify any legitimate sources that are failing authentication and fix their SPF or DKIM configuration. Address any unauthorized sources you discover.
Step 6: Tighten Your Policy
Once all legitimate sources pass authentication consistently, move to p=quarantine to send failing emails to spam. After confirming no legitimate email is affected, move to p=reject for full protection.
Ongoing Monitoring
Email authentication is not a set-and-forget configuration. You should:
- Review DMARC reports regularly to catch new unauthorized senders or configuration issues
- Update SPF and DKIM when you add or change email sending services
- Rotate DKIM keys periodically
- Monitor your domain reputation using tools like Google Postmaster Tools
The Cost of Doing Nothing
Failing to implement email authentication leaves your domain open to abuse. Attackers can impersonate your organization with no technical barriers, and there is nothing you can do about it after the fact. The damage to your brand reputation, customer trust, and email deliverability can be significant and long-lasting.
SPF, DKIM, and DMARC are free to implement -- they are DNS records and mail server configurations. The cost of setting them up is minimal compared to the cost of having your domain spoofed in a phishing campaign that targets your customers or partners.
Protect your domain, protect your reputation, and protect the people who trust your email.
