.png)
What is email spoofing?
Email spoofing is the forgery of the "From" address in an email so it appears to come from a trusted sender — your CEO, your bank, a vendor, or even your own domain. Because SMTP (the protocol that delivers email) was designed in 1982 with no authentication, anyone can send mail claiming to be anyone.
Spoofing is the foundation of phishing, BEC, and vendor fraud. The attacker doesn't need to compromise your email server — they just need to convince your recipient that the message is legitimate.
Figure 1 — SPF, DKIM, and DMARC work as a chain. DMARC is the policy layer that enforces what happens when SPF or DKIM fail.
The three authentication records explained
| Record | What it does | Where it lives | Stops |
|---|---|---|---|
| SPF | Lists every IP address authorized to send mail for your domain | DNS TXT record | IP-level spoofing from unauthorized servers |
| DKIM | Adds a cryptographic signature to every outbound message | DNS TXT record (public key) + mail server (private key) | Message tampering in transit |
| DMARC | Ties SPF + DKIM together and sets the policy (none / quarantine / reject) | DNS TXT record | Domain spoofing — tells receivers what to do with failures |
Why "monitor only" DMARC is dangerous
Most organizations publish DMARC with p=none — monitor mode — and never move to enforcement. This means spoofed messages still reach inboxes; you just get a report about it. DMARC only stops spoofing when set to p=quarantine or p=reject.
The reason organizations stay in monitor mode: they're afraid of breaking legitimate mail flows (newsletters, CRMs, HR systems). IDENETY's approach is to audit all sending sources first, fix SPF/DKIM for each, then move to enforcement safely.
Common spoofing attack types
| Attack Type | How it works | Defense |
|---|---|---|
| Exact-domain spoofing | From: [email protected] sent by attacker's server | DMARC enforcement (p=reject) |
| Display-name spoofing | From: "CEO Name" <[email protected]> | AI / behavioral detection in Defender 365 |
| Lookalike domain | From: [email protected] or [email protected] | Impersonation protection, domain monitoring |
| Compromised vendor account | Legitimate email from a hacked supplier | Behavioral AI, vendor risk management |
IDENETY email authentication services
- SPF / DKIM / DMARC audit and enforcement — included in COMPLETE plan.
- Microsoft Defender for Office 365 impersonation protection tuning.
- DMARC aggregate reporting and ongoing monitoring.
- Email Security add-on from $10/mailbox for organizations on CORE.
See our DNS records guide for the full technical walkthrough of SPF, DKIM, and DMARC record syntax. For the broader email threat picture, see Email Security: Stopping Phishing, Spoofing & BEC.
Contact our engineers to schedule an email authentication audit for your domain.
