Glossary

Email Spoofing — How It Works and How to Stop It

Email spoofing is the forgery of an email's From: header to make it appear to come from a domain the sender does not control. Attackers use spoofed emails for phishing, fraud, and brand impersonation. SPF, DKIM, and DMARC are the three DNS-based standards that together prevent email spoofing.

How Email Spoofing Works

SMTP does not verify the From: header by default. Any mail server can claim to send from any domain. Without SPF, DKIM, and DMARC configured, anyone can send email appearing to come from your domain.

How to Prevent Email Spoofing

1. Publish an SPF record listing authorized senders
2. Enable DKIM signing on your mail server
3. Set DMARC to p=quarantine or p=reject
4. Monitor DMARC aggregate reports for unauthorized senders

DMARC p=reject Stops Spoofing

With DMARC p=reject, receiving servers will block any email that fails both SPF and DKIM alignment — preventing spoofed emails from reaching inboxes entirely.