Email Spoofing

Email was designed in a trusting era. The SMTP protocol doesn't verify that the sender is who they claim to be, it's like the postal service delivering a letter regardless of the return address.

Attackers exploit this by:

• ●Setting up their own mail server
• ●Crafting emails with a forged 'From' address
• ●Sending to targets who see a trusted sender

Without authentication, receiving servers have no way to verify the email actually came from the claimed sender.

Phishing attacks Impersonating banks, tech companies, or colleagues to steal credentials.

Business Email Compromise Spoofing CEO emails to trick employees into wire transfers.

Spreading malware Trusted sender = recipient more likely to open attachments.

Reputation damage Send spam appearing from a competitor to damage their reputation.

Evading filters Spoofed emails from trusted domains may bypass spam filters.

Implement all three authentication protocols:

SPF - Lists authorized sending IPs Anyone sending from other IPs fails SPF.

DKIM - Cryptographically signs your emails Spoofed emails can't have valid signatures without your private key.

DMARC - Enforces policy on failures Tells receivers to reject or quarantine emails that fail SPF/DKIM.

With p=reject DMARC policy, spoofed emails are blocked before reaching targets.

When receiving emails, look for:

Header analysis

• ●Check Received headers for origin
• ●Look for SPF/DKIM/DMARC results
• ●Verify Return-Path matches From

Visible red flags

• ●Urgency or threats
• ●Requests for credentials or money
• ●Slightly misspelled domains
• ●Suspicious links (hover to check)

Technical checks

• ●Failed SPF/DKIM (check headers)
• ●Mismatched domains
• ●Unusual sending server