What is email spoofing?

Definition

Email spoofing is sending a message whose From address claims a sender it did not come from, most often somebody else's domain. It works because SMTP, designed in a more trusting era, does not verify the From line: any server can transmit a message claiming to be finance@yourcompany.com. Without authentication policies, receivers have no way to know better.

Spoofing is not a compromised account

The two get conflated, and the difference decides your response:

• Spoofing: the attacker never touched your systems. Nothing of yours is breached; your domain's name is being borrowed on infrastructure you have never seen. The fix is policy: publish authentication and tell receivers to enforce it.
• Account compromise: the attacker sends real mail from your real account, which passes SPF, DKIM, and DMARC honestly. The fix is credentials: reset, revoke sessions, audit. No DMARC policy catches it, because the mail really is yours.

What makes spoofing fail

The authentication stack, working together: SPF names the servers allowed to send for your domain, DKIM cryptographically signs your real mail, and a DMARC record at an enforcement policy tells receivers to spam-folder or refuse mail that fails both with your name on it. At p=none you can watch spoofing happen in your aggregate reports; at p=reject receivers refuse it before anyone sees it. Domains that send no mail at all still need this, published in its strictest form, because a parked domain with no policy is the cheapest thing on the internet to impersonate.

What DMARC cannot stop

Lookalike attacks survive: a registered yourcompany-billing.com, a homoglyph domain, or a trusted display name over a random mailbox all pass authentication for the domain they really use. DMARC covers your exact domain; impersonation beyond it is fought with monitoring, takedowns, and reader skepticism.