When the From line is not proof
What Is Email Spoofing? How Forged Sender Addresses Work
Email spoofing forges sender information so a message appears to come from a trusted domain. It is different from lookalike domains, display-name impersonation and compromised real accounts.
The From line looks authoritative because normal email makes it feel like identity. Technically, it is a field inside a message. Email spoofing exploits that gap by forging sender information so the visible address appears legitimate even though the attacker did not send from the legitimate sender's account.
Why the visible sender can be forged
Cloudflare explains that SMTP does not provide built-in authentication of the visible sender identity in the way users often assume. Email also has two relevant layers: the message headers people see and the SMTP envelope servers use for transport. Those values do not have to be identical.
An attacker can therefore construct a message whose visible From field claims a trusted domain. Modern receiving systems try to detect that mismatch using authentication and reputation signals, but the visible address alone is not cryptographic proof of origin.
Spoofing is not the same as every other impersonation trick
| Technique | What changes | Example risk |
|---|---|---|
| Header spoofing | The visible sender information is forged | The message appears to come from a real domain the attacker does not control |
| Lookalike domain | The attacker registers a similar domain | mail0nce.example resembles mailonce.example but is not the same domain |
| Display-name impersonation | Only the friendly name is copied | The inbox shows 'Finance Team' while the underlying address is unrelated |
| Compromised real account | The attacker actually controls a legitimate mailbox | Authentication may pass because the account or sending system is real |
What SPF, DKIM and DMARC contribute
SPF lets a domain publish which servers are authorized to send for it. DKIM uses a cryptographic signature to authenticate a sending domain and detect modification of signed content. DMARC connects authentication results to the visible From domain and lets a domain publish a handling policy for failures.
These mechanisms make simple domain spoofing harder, but they do not make every authenticated email safe. A phishing message from a newly registered lookalike domain can authenticate correctly for that fake domain. A compromised legitimate account can also send malicious mail while passing authentication.
What a recipient should verify
- Expand the full sender address instead of trusting the display name.
- Check the exact domain spelling, not just the brand name shown beside it.
- Treat unexpected Reply-To domains as a reason to investigate further.
- Use message headers or your provider's authentication view when the message is high risk.
- Verify sensitive requests through a contact path you already know rather than replying to the suspicious message.
The important lesson is not that every From address is fake. It is that the From line is a claim, and high-stakes claims deserve independent verification plus authentication signals.
Put this threat in context
Sources and further reading
Need a separate inbox for a short-lived interaction?
Temporary email can reduce exposure of your durable address when future recovery is not important. It is one privacy layer, not a replacement for account security.
Create temporary email