Plain-language guide
Email spoofing, explained
Email spoofing is sending email that pretends to come from your domain. Nothing of yours is hacked and no password is stolen — email’s original design lets anyone write any address on the “From” line, the way anyone can write any return address on an envelope.
Here is the part that catches most people out: when your domain is spoofed, you are not involved. The email goes straight from the attacker to your supplier, your customer or your partner. You don’t send it, you don’t receive it, and nothing appears in your systems — so you never see the problem. Often the first sign is a phone call about an invoice you never sent.
How it works — and how you find out
- 1.An attacker sends email using your domain to one of your suppliers, vendors or partners, posing as you, a company director or your accountant.
- 2.The recipient’s mail service looks up your domain’s DMARC record in DNS. The record tells it two things: how to treat mail from your domain that doesn’t come from an authorised source, and where to send reports about every message claiming to be you.
- 3.Spoofhound receives those reports and turns them into a clear picture: where email “from” your domain is really coming from, which of those sources are legitimate, and when you can safely tell the world’s mail servers to reject the fakes.
1Attacker
sends email “from”
your domain
Recipient’s
mail service
your supplier or customer
where to report
2Your DMARC record
published in your DNS
3Spoofhound
receives and analyses
the reports
when to block
You
the domain owner
The reports are how you find out.
Why not just block all spoofed email today?
Because to a mail server, “spoofed” just means “not from an authorised source” — and some of your genuine email is probably sent that way right now. Your CRM, payroll, invoicing or marketing platform may be sending as your domain without being configured as a legitimate source. Tell the world to block unauthorised mail today and you block those too.
Spoofhound shows you exactly which sources send mail as your domain, which of them need to be configured correctly, and tells you when it is safe to switch to blocking — so you stop the attackers without stopping payroll.
What you end up with
Once your domain is at DMARC enforcement, email forging your exact domain is rejected before it reaches anyone, you keep proof that it stays that way, and you see new spoofing attempts as they happen.
Forging your exact domain is only one of the ways business email compromise is done — the honest breakdown of the others is on our business email compromise page.
Find out in 30 seconds whether your domain can be spoofed right now.