Email spoofing explained: how fake senders work
2 min read · Updated October 15, 2026
Email spoofing is forging the ‘From’ address so a message appears to come from someone else. It does not require access to the real account. Check the full sender and headers when something seems off, and domain owners can block spoofing with SPF, DKIM and DMARC.
How spoofing works
Email was designed without strong sender verification. An attacker can set the visible sender to any address or name, much like writing a false return address on an envelope. Modern authentication checks help receivers spot forgeries, but they are not universal.
Spoofed or hacked?
If messages from your address appear in other people’s inboxes but not in your Sent folder, your address was probably spoofed. If they are in your Sent folder, the account was likely accessed by someone else.
Got a suspicious email about a leak?
Scammers love leaked data. See whether your address is genuinely in a known breach so you know how much of the message is real.
Spotting spoofed mail
- ✓The display name looks right but the underlying address is different.
- ✓Email authentication results show a failure in the message details.
- ✓The tone, request or timing is unusual for the supposed sender.
- ✓Replies go to a different address than the sender.
Stopping spoofing of your domain
If you own a domain, publish SPF, DKIM and DMARC records. Together they tell receiving servers which sources may send mail for your domain and what to do with messages that fail the checks.
Frequently asked questions
Can I stop someone spoofing my address?+
Individuals using a public provider cannot fully prevent it. Domain owners can reduce it with email authentication records.
Is spoofing illegal?+
Using it to deceive or defraud is illegal in many places. Enforcement is difficult, so prevention matters.
Does a spoofed message mean my password leaked?+
No. Spoofing does not need your password. It may still be wise to check for breaches.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.