EMailSpoofing

EMailSpoofing refers to the creation of email messages with a forged sender address, intended to mislead recipients about who sent them. The forged From header can make messages appear to come from a legitimate person or organization, even though the actual sending server may be unrelated. Spoofing can be based on display-name manipulation, look-alike domains, or compromised accounts, and it is commonly used to facilitate phishing, fraud, or social engineering.

How it works: The SMTP protocol does not reliably authenticate headers, allowing attackers to set arbitrary From values. The envelope sender (used for delivery) may differ from the visible From, enabling mismatches that bypass naive checks. Attackers may register similar-looking domains or use victims' domains to increase credibility.

Defenses: Email authentication standards aim to prevent spoofing. SPF (Sender Policy Framework) records authorize sending hosts; DKIM (DomainKeys Identified Mail) provides cryptographic signatures; DMARC (Domain-based Message Authentication, Reporting & Conformance) requires alignment between SPF/DKIM and the From header and can instruct receivers how to handle failures. ARC (Authenticated Received Chain) helps preserve authentication across intermediaries. End-to-end encryption like S/MIME or PGP can provide recipient-side verification. Email gateways, anti-spam filters, and user education also reduce risk. Monitoring DMARC reports helps domains detect abuse and adjust policies.

Impact: Spoofing enables phishing, business email compromise, fraud, and reputational damage. Awareness, strong authentication, and technical controls are essential to mitigate risk.