Email spoofing

Email spoofing is forging the sender of a message. It works because the From: header every recipient reads is free text the sending system writes, and SMTP contains no mechanism to verify it. A message can claim to come from any domain in the world and it will still be delivered. This is not a vulnerability introduced at some point; it is the default behaviour of a protocol designed for a small network of people who already trusted each other.

Spoofing takes three forms worth telling apart. Exact-domain spoofing forges your real domain in the From: header, and is the one DMARC at p=reject actually blocks. Lookalike or cousin domains use a name close enough to fool a reader, such as an extra hyphen or a swapped character, and they authenticate perfectly because the attacker genuinely owns them and publishes their own records. Display-name spoofing puts a trusted person’s name in the friendly-name portion of the From: header while the address beside it is unrelated, which is especially effective on phones, where many mail clients show only the name.

Only the first is a technical forgery, and only the first is solved by publishing DNS records. The other two need brand monitoring, domain registration watch, and people who know to check the actual address. Spoofing is the delivery mechanism behind most phishing and much business email compromise.