# Email spoofing

> Understand how email spoofing works, how to recognise a spoofed message and how SPF, DKIM and DMARC protect your domain.

Source: https://helpcenter.ruachost.com/email/guides/email-spoofing/

**Email spoofing** is a technique used by attackers to disguise the origin of an email by altering the header information. The goal is to trick recipients into believing the message comes from a trusted source, often leading them to click malicious links or disclose sensitive information.

## Why Email Spoofing Is Dangerous

- Spoofed emails appear to come from legitimate senders (banks, colleagues, service providers).
- They often contain well‑crafted content that is difficult to distinguish from genuine messages.
- Victims may unknowingly share personal or financial information.
- Clicking links or attachments can install malware or give attackers access to systems.

## How to Identify Email Spoofing

- **Check the display name and email address** → Hover over the sender name to verify the actual address.
- **Check the reply path** → When replying, ensure the address matches the original sender.
- **Examine the tone and content** → Look for unusual urgency, grammar mistakes, or suspicious requests.
- **View email headers** → Inspect technical details to confirm the true sending server.

## Difference Between Spoofing and Phishing

- **Phishing** → Emails request sensitive information directly (e.g., credit card numbers, PINs).
- **Spoofing** → Emails use falsified headers/IPs to impersonate trusted senders, often leading to phishing attempts.

## How to Prevent or Stop Email Spoofing

- **Enable spam filtering** → Use cPanel’s automated filters to block suspicious messages.
- **Implement authentication protocols**:

  - **SPF (Sender Policy Framework)** → Lists authorized IPs allowed to send mail for your domain.
  - **DKIM (DomainKeys Identified Mail)** → Uses cryptographic signatures to verify authenticity.
  - **DMARC (Domain‑based Message Authentication, Reporting & Conformance)** → Combines SPF and DKIM to enforce policies and report spoofing attempts.
- **Educate users** → Train staff to recognize spoofed emails and avoid clicking suspicious links.

> **Note:**
- Deleting spoofed emails is often the safest response.
- Report suspected spoofing attempts to ruachost support or IT team.
- Regularly review and update domain DNS records to strengthen email security.