.png&w=3840&q=75)
Privacy & Security3 min
What is Email Spoofing and How Do You Stop It?
NS
NameSilo Staff8/26/2026
Share
Email spoofing is a cyberattack where a hacker forges the "From" address of an email to make it appear as though it was sent by a legitimate company or trusted individual. Because the core email protocol (SMTP) lacks built-in security, anyone can spoof an unprotected domain. To stop it, you must deploy strict SPF, DKIM, and DMARC authentication records.
The Envelope vs The Letterhead
Standard email has two separate identity fields, and this split is exactly why spoofing works.
The Envelope (Return-Path): The technical, behind-the-scenes address used for delivery and bounce handling. SPF checks this.
The Letterhead (visible "From" header): What the recipient actually sees in their inbox. Standard SMTP never requires these two fields to match.
A hacker can send mail through a server SPF authorizes, satisfying the envelope check, while displaying an entirely different, forged name and address on the visible letterhead the recipient reads. SPF alone cannot catch this, because SPF was never designed to inspect the letterhead at all.
Why It Matters: The Billion-Dollar BEC Industry
Business Email Compromise (BEC), the exact attack where a fake CFO or CEO email requests a wire transfer, is not a rare event. The FBI's IC3 2025 Internet Crime Report recorded $3.05 billion in BEC losses from 24,768 complaints, one of the most financially damaging cybercrime categories tracked. The majority of those losses moved via wire transfer, often unrecoverable within hours of the transaction.
A single convincing spoofed email, no malware, no hacking, just a forged letterhead, can cost a company more than years of security spending combined.
The Core Defense: SPF and DKIM
SPF (Sender Policy Framework) publishes a DNS record listing every server authorized to send mail for your domain. Receiving servers check the envelope address against this list.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing mail, letting receivers verify the message wasn't altered in transit and genuinely originated from an authorized signing key.
Both matter, but both check different layers than what the recipient actually sees, which is why neither alone stops the attack a CEO actually experiences.
The Ultimate Block: DMARC Reject
DMARC is the layer that finally connects the two. It requires alignment between the authenticated domain (from SPF or DKIM) and the visible "From" letterhead the recipient sees. If they don't match, and your policy is set to p=reject, receiving servers refuse the message outright, deleted before it ever reaches an inbox.
Without DMARC at enforcement, a message can pass SPF perfectly on the envelope while displaying a completely forged letterhead, and still land in the CEO's inbox looking authentic.
Common Mistakes
Configuring SPF and DKIM but leaving a catch-all address active: A catch-all accepts mail for literally any username at your domain, [email protected] gets delivered just like [email protected]. This makes your domain a magnet for backscatter: spammers forging your domain elsewhere generate bounce floods back to your catch-all, and directly-targeted junk mail to nonexistent addresses gets silently accepted instead of rejected. Set unknown-recipient handling to reject at the protocol level rather than accepting everything.
Stopping at p=none: Publishing DMARC without ever advancing to p=reject provides monitoring visibility but zero actual blocking power.
What This Means for You
Harden your domain's identity with NameSilo Email authentication settings, and configure SPF, DKIM, and DMARC directly through DNS Manager. Need a domain to secure from day one? Search available names.
Frequently Asked Questions
What is email spoofing?
Forging the visible sender address to impersonate a trusted domain or person.
How do hackers spoof an email address?
By manipulating the From header, a field standard SMTP never verifies.
Can I track down who spoofed my email?
Rarely with certainty; headers can reveal the originating server in some cases.
Does DMARC prevent email spoofing?
Yes, when set to p=reject, by blocking unaligned forged messages outright.
What is Business Email Compromise?
Fraud where attackers impersonate executives to redirect company payments.
How do I authenticate my domain emails?
Publish SPF, DKIM, and DMARC records through your DNS provider.
Can a spoofed email contain a virus?
Yes. Spoofing is often paired with malicious attachments or links.
How do I add DMARC records at NameSilo?
DNS Manager, add a TXT record at host _dmarc, paste your policy string.
.png&w=2048&q=75)
NameSilo StaffThe NameSilo staff of writers worked together on this post. It was a combination of efforts from our passionate writers that produce content to educate and provide insights for all our readers.
More articleswritten by NameSilo
.png&w=3840&q=75)
.png&w=3840&q=75)