Email spoofing explained: how someone can send a message that looks like it came from you

Spoofing means sending an email that appears to come from someone else's address. It does not require access to their account. That is why scammers can send a message "from" your own address, your boss or your bank without ever signing in as them.

Why it is possible

The original design of email trusts whatever the sender says about who they are. Think of a letter: anyone can write any return address on the envelope. Modern checks were added later to help receiving mailboxes spot the fakes.

The three checks, in plain language

• SPF is a published list of the servers allowed to send mail for your domain.

• DKIM adds a digital signature to your messages, so receivers can tell they were not altered.

• DMARC tells receivers what to do with messages that fail those checks: accept, quarantine or reject them.

What they do and do not do

Set up well, they make it much harder for others to send convincing mail in your name, and they help your genuine emails reach inboxes. They do not stop every scam, and they cannot stop someone using a look-alike address, such as one with a swapped letter.

A simple routine

1. Check that your domain has all three set up, especially after changing email provider or adding a new tool that sends mail for you.

2. Start gently. Monitor first, then tighten the DMARC policy once you are confident legitimate mail passes.

3. Review it a couple of times a year. New newsletter tools and forms are common causes of mail failing checks.

For your team

Remind people that "from" lines can be faked. If a message is unusual, verify it another way.

How we can help

We look after these settings as part of caring for your online presence. To have yours checked, ask our team about a security review.