Article Email

What is email spoofing, and can you prevent it?

How a spoofed email fakes its sender address, why it is possible at all, and the records that make it harder to pull off.

iFastHosting Support Team Updated 26 August 2026 8 min read Intermediate

Email spoofing is sending a message with a "From" address that does not actually belong to the sender. The recipient's inbox shows a name and address they recognise, or one that looks plausible for the context, while the message actually originated somewhere else entirely. It is not a hack of the real account — the genuine mailbox is usually untouched — it is a forgery of the label attached to a completely different message.

Why this is possible at all

Email was designed in the 1980s, on a network where everyone connected to it was assumed to be trustworthy. The "From" field is, at its core, simply a line of text the sending software writes — nothing in the original protocol checks that it matches who is actually sending. Decades later, that design choice is still there, which is exactly why SPF, DKIM and DMARC exist: they are patches added afterwards to let a receiving server check what the protocol itself never verified.

Spoofing is not the same as your account being hacked

If someone has actually broken into your mailbox and is sending from it directly, that is a compromised account, not spoofing — the mail genuinely comes from your server using your real credentials. Spoofing forges the From address without ever touching your account, from a completely different server. The fix for a compromised account is changing the password; the fix for spoofing is authentication records on your domain.

What spoofed mail is typically used for

Phishing — a message appearing to come from a bank, a supplier or a colleague, asking the recipient to click a link or hand over information.
Invoice fraud — a message spoofing a known supplier's address, asking for payment to a changed bank account.
Impersonating your own domain to your own contacts — perhaps the most unsettling version, where someone sends spam or a scam that appears to come from your address to people who know and trust you.
Backscatter — spoofed mail that bounces, with the bounce notification landing in the mailbox of the person whose address was forged, even though they never sent anything.

How to tell a spoofed message from a genuine one

The visible "From" name and address are exactly what is being forged, so they cannot be trusted on their own. What can be checked:

View the full message headers (usually "show original" or "view source" in a mail client) and look for an Authentication-Results line showing whether SPF and DKIM passed or failed for that specific message.
Check the actual sending server, shown further down the headers as a Received: line, against where the claimed sender would normally send from.
Be suspicious of urgency — a request for payment, a password reset, or an account verification that pressures quick action is a common thread across spoofed and phishing mail regardless of the technical details.

How to stop your own domain being spoofed

You cannot prevent someone typing your address into the "From" field of an email they send — that part of the protocol cannot be locked down retroactively. What you can do is make it so that when they try, receiving mail servers reject or flag the result instead of delivering it as if it were genuine.

SPF: whitelist your real servers

An SPF record lists the servers allowed to send as your domain. A spoofed message sent from anywhere else fails this check the moment a receiving server looks it up. See setting up an SPF record.

DKIM: sign your genuine mail

DKIM signs your real outgoing mail cryptographically. A spoofed message cannot reproduce a valid signature without your private key, so it simply has no signature at all, or an invalid one. See setting up DKIM signing.

DMARC: tell receiving servers what to do about it

SPF and DKIM alone still leave a decision unmade — what should a receiving server actually do with mail that fails? DMARC answers that with a policy, and closes a specific gap the other two leave open: it requires the domain that passed authentication to match the domain the recipient actually sees, which stops a technically-passing message from displaying a different address to the reader. See setting up a DMARC record for how to publish one and roll out a stricter policy safely.

None of this stops mail arriving — it stops it succeeding

Even a domain with all three records perfectly configured can still be typed into a spoofed message's From field by someone attempting it. What changes is the outcome: the message now fails authentication checks at the receiving end, and with a DMARC policy of quarantine or reject in place, it is filtered or refused rather than delivered as if genuine.

What to do if you suspect you are being spoofed

Check your DMARC reports if you have DMARC set up already — they list every server sending mail claiming to be from your domain, including ones that are not you.
Confirm SPF, DKIM and DMARC are all in place if they are not already, starting with SPF, DKIM and DMARC explained.
Warn contacts if the spoofing is targeting people who know you, particularly if the spoofed mail asks for money or sensitive information, since a quick warning can stop someone falling for it before it succeeds.
Check your own domain has not also been blacklisted as a side effect — see what to do if your domain is blacklisted, since a wave of spoofed mail using your address can sometimes get the domain itself flagged even though you were not the one sending it.

Spoofing exploits a genuine gap in how email was originally designed, not a flaw specific to any one host or provider. Closing that gap for your own domain is entirely within your control, and it is the same three records worth setting up regardless of whether you currently suspect a problem.