Email Spoofing
How forging a sender address works, why the protocol permits it, and what actually stops someone spoofing an email from your company.
- SmithDental Office8:47 AMAppointment Reminder · See you Thursday at 2:30.
Hi, our records show your card on file has expired. Please update your payment details before your next visit.
DMARC failedSPF soft failDKIM missing- LabQuest Results9:26 AMYour Results Are Ready · The panel from Monday is available.
- No Login
- No Software
- No Network Access
- Public Records Only
Read the way an outsider would, from records that are already public.
A Forged Message That Was Delivered
Authentication failed on every check and the message still arrived. Nothing in it tells the reader anything went wrong.
Please update payment details for future invoices.
deliveredThe message reached the inbox looking like it came from you.
How Spoofing an Email Works
Email spoofing is forging the sender address on a message so it appears to come from someone else. It requires no password and no intrusion of any kind.
The reason is in the protocol. The sender supplies the from address as a value, and the original specification had no way to verify it. A return address on an envelope is written by whoever posts the letter, and nothing at the post office checks it.
How to Tell a Spoofed Email
Read the Address, Not the Name
Mail clients show a display name and hide the address behind it. That name is arbitrary text the sender chose.
Check the Reply Path
A spoofed message often sets a different reply address, so your response reaches the attacker instead.
Question the Request
Formatting and logos copy perfectly. The request is the only thing worth judging.
Confirm on a Known Number
Phone the person on a number you already had, never the one in the message.
What Actually Stops It
SPF Lists Your Senders
The servers permitted to send as your domain.
DKIM Signs Your Mail
A signature proving the message came from you and was not altered.
DMARC Makes the Decision
It tells receiving servers to refuse mail the first two do not confirm. Without it, they produce evidence nobody acts on.
Who Actually Gets Hurt
Not usually the business whose domain is forged. The message goes to that business's customers, suppliers, and staff, so the damage lands on the people who trusted the name.
A customer who pays a forged invoice was defrauded using your identity, and the conversation that follows is difficult regardless of where fault legally sits.
What a Report Says About It
The finding names the consequence rather than the record, because a missing DMARC policy means nothing to the person who has to authorize the fix.
Common Questions
Sending forged email in furtherance of fraud is illegal in most jurisdictions. The technical act of setting a from address is not itself an intrusion, which is part of why publishing the protections is the sender's responsibility.
Yes, unless your domain publishes DMARC set to reject. The provider secures your account. It does not stop someone elsewhere writing your address into a message they send.
Because the receiving server had no instruction to refuse it. Without a DMARC policy most providers deliver, since discarding legitimate mail is the worse error from their side.
No, and this is the most common misunderstanding. Spoofing needs no access to your account. If messages appear in your sent folder, that is a compromised account and a more urgent problem.
Blindspot does not send spoofed messages and does not test whether spoofing succeeds. It reads public records only, specifically the SPF, DKIM and DMARC records published in a domain's DNS, and reports what they permit. Blindspot is not a penetration test. Nothing is logged into, no password is tested, and no network is touched.
Check Whether Your Domain Can Be Spoofed
Reads all three records and tells you what they permit. Free, about thirty seconds.
We only read public records. We never touch your computers and we never ask for a password.
Keep Reading
Three places this leads next, depending on what you want to do about it.
- Free ToolHow to Stop Email SpoofingEmail spoofing is stopped with three DNS records, not with software. Here is what spoofing actually is, why filters cannot catch it, and the exact steps that block someone sending mail as your company.
- Free ToolFind Out If Your Domain Can Be ForgedCheck whether your domain has a DMARC record and whether its policy blocks forged email. Free business-domain result, with no login or network access.
- ExplainerTyposquattingTyposquatting registers domains that resemble yours to intercept traffic or send convincing email. Here is how it works, why a lookalike with a mail server is an attack already underway, and how to check for yours.