# What is Email Spoofing?

> Email spoofing is the falsification or imitation of sender information so that a message appears to come from a trusted person, organization, or domain.

- Canonical URL: https://yellowcube.eu/glossary/email-spoofing/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

An attacker may manipulate the visible display name, use an unauthorized address in the From field, send through a lookalike domain, or create a reply path that leads somewhere unexpected.

Different forms require different defenses. SPF, DKIM, and DMARC can help receiving systems detect unauthorized use of a protected domain, but they do not stop display-name impersonation or a newly registered lookalike domain. Visual inspection alone is also unreliable on small screens or where mail clients hide address details.

### Key points

- **Direct domain spoofing:** The message claims to use a domain the attacker does not control.
- **Lookalike domain:** The attacker registers a similar but distinct name, so authentication may succeed for the attacker’s own domain.
- **Display-name spoofing:** The friendly name imitates a person or brand while the underlying address differs.
- **Important limitation:** Spoofing does not require account compromise, and account compromise does not require spoofing; a genuine mailbox can send a fraudulent request.

### Related terms

[Domain-based Message Authentication, Reporting, and Conformance (DMARC)](<https://yellowcube.eu/glossary/domain-based-message-authentication-reporting-and-conformance/>) · [Phishing](<https://yellowcube.eu/glossary/phishing/>) · [Business email compromise (BEC)](<https://yellowcube.eu/glossary/business-email-compromise/>) · [DomainKeys Identified Mail (DKIM)](<https://yellowcube.eu/glossary/domainkeys-identified-mail/>) · [Sender Policy Framework (SPF)](<https://yellowcube.eu/glossary/sender-policy-framework/>)

### Sources

[NIST SP 800-177r1: Trustworthy Email](https://csrc.nist.gov/pubs/sp/800/177/r1/final) · [RFC 9989: DMARC](https://www.rfc-editor.org/info/rfc9989/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.