Email Spoofing
Forging email headers to make messages appear to come from a different sender, commonly used in phishing and business email compromise.
Email spoofing is the creation of email messages with a forged sender address, making them appear to originate from someone other than the actual source. The Simple Mail Transfer Protocol (SMTP), which underpins email delivery, does not include built-in authentication for sender addresses, allowing anyone to send an email that appears to come from any address. Attackers exploit this fundamental design limitation to impersonate trusted individuals, organizations, or automated systems in phishing campaigns, business email compromise, and spam distribution.
The technical process of email spoofing is straightforward. An attacker configures a mail server or uses command-line tools to set the "From," "Reply-To," and display name fields to any desired values. More sophisticated spoofing modifies additional headers to better mimic legitimate email infrastructure. Without proper email authentication, the recipient's mail server has no reliable way to verify that the claimed sender actually sent the message. This allows attackers to send emails that appear to come from a CEO, a trusted vendor, a bank, or any other entity.
Email spoofing enables a wide range of attacks. Business email compromise (BEC) uses spoofed executive emails to authorize fraudulent wire transfers. Phishing campaigns spoof trusted brands to harvest credentials. Spoofed emails can damage reputations by sending offensive content under someone else's name. The primary defense against email spoofing is the implementation of email authentication protocols: SPF (Sender Policy Framework) specifies which servers can send email for a domain, DKIM (DomainKeys Identified Mail) cryptographically signs messages, and DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together with enforcement policies. Organizations should implement all three at enforcement levels.
The technical process of email spoofing is straightforward. An attacker configures a mail server or uses command-line tools to set the "From," "Reply-To," and display name fields to any desired values. More sophisticated spoofing modifies additional headers to better mimic legitimate email infrastructure. Without proper email authentication, the recipient's mail server has no reliable way to verify that the claimed sender actually sent the message. This allows attackers to send emails that appear to come from a CEO, a trusted vendor, a bank, or any other entity.
Email spoofing enables a wide range of attacks. Business email compromise (BEC) uses spoofed executive emails to authorize fraudulent wire transfers. Phishing campaigns spoof trusted brands to harvest credentials. Spoofed emails can damage reputations by sending offensive content under someone else's name. The primary defense against email spoofing is the implementation of email authentication protocols: SPF (Sender Policy Framework) specifies which servers can send email for a domain, DKIM (DomainKeys Identified Mail) cryptographically signs messages, and DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together with enforcement policies. Organizations should implement all three at enforcement levels.
Examples
- A phishing email with a forged sender address matching the company CEO directs the finance team to wire funds to a fraudulent account.
- Spam emails spoofing a trusted e-commerce brand promote fake deals that lead to credential-harvesting sites.
- An attacker sends spoofed emails from a partner company's domain containing malware-laden attachments.
Prevention
- Implement SPF, DKIM, and DMARC on your domain with a DMARC policy of "reject" or "quarantine."
- Configure email gateways to flag or reject messages that fail authentication checks.
- Train employees to inspect email headers and be suspicious of unexpected requests, even from known senders.
- Use email security solutions that analyze sender reputation and detect header anomalies.