Spoofing is faking the source of a communication, an email sender, a domain, a caller ID, a website, or an IP address, so it appears to come from someone the target trusts. It is the enabler behind most phishing and fraud.

What is the difference between spoofing and phishing?

Spoofing is the technical act of faking the source. Phishing is the deception that uses it to steal a credential or trigger an action. Most phishing relies on some form of spoofing to look convincing.

What is email spoofing and how do you stop it?

Email spoofing forges the sender so a message appears to come from a trusted address or your own domain. You stop it by publishing SPF, DKIM, and DMARC records so receiving mail servers can detect and reject forged mail.

What is domain spoofing?

Domain spoofing uses a lookalike domain, swapped letters or homoglyphs, to impersonate a real one. Registering the obvious lookalikes yourself and monitoring Certificate Transparency logs helps you catch it early.

How do you protect against spoofing?

Authenticate your email with SPF, DKIM, and DMARC, use HTTPS and HSTS, register and monitor lookalike domains, apply DNSSEC and network anti-spoofing where relevant, and verify unexpected requests on a channel you already trust.

What is Spoofing? Email, Domain, Caller ID, and IP

Cyber threats · LearnSecurity services Download PDF

TL;DR

Spoofing is faking the source of a communication so it appears to come from a trusted party: a forged email sender, a lookalike domain, a faked caller ID, or a spoofed IP or website. It is the enabler behind phishing and fraud. The defenses are authenticating the source (email SPF, DKIM, and DMARC; HTTPS; DNSSEC) and verifying unexpected requests on a channel you already trust.

By Pranav Khune, Lead Pentester, SecureLayer7Updated September 8, 2026

The main types of spoofing

Spoofing shows up wherever a source can be faked:

Email (sender) spoofing: forging the From address so mail looks internal or from a supplier.
Domain spoofing: registering a lookalike domain using swapped letters or homoglyphs (secur1ty for security).
Caller ID and SMS spoofing: faking the number a call or text appears to come from.
Website spoofing and DNS spoofing: a fake site, or poisoned DNS that sends users to it.
IP spoofing: forging a source IP address, used in some network attacks.
ARP spoofing: impersonating a device on a local network to intercept traffic.

How spoofing enables attacks

Spoofing is rarely the whole attack; it is the part that makes the rest believable. Phishing works because the sender looks real. Business email compromise works because the request appears to come from your CEO. Fraudulent sites harvest credentials because the address looks right.

In other words, spoofing supplies the trust that social engineering spends. Break the spoofing, and most of these attacks lose their disguise.

How to spot spoofing

The signs are usually small mismatches:

The display name looks right but the actual email address or domain is off by a character.
Email authentication (SPF, DKIM, DMARC) is missing or failing, which your mail provider can flag.
A website's certificate warning, or a URL that is almost, but not quite, the real one.
A call or message asking for something unusual from a number you cannot independently confirm.

When in doubt, do not trust the channel that contacted you; reach the person or company through details you already have.

How to prevent spoofing

You cannot stop others from trying, but you can make impersonating you hard and make spoofed messages fail:

Email authentication: publish SPF, DKIM, and DMARC so receivers can reject mail that forges your domain, and enforce DMARC over time.
Register lookalike domains and monitor Certificate Transparency logs for new certificates that impersonate you.
HTTPS and HSTS so users reach the real you and browsers refuse downgrades.
DNSSEC and network anti-spoofing where applicable.
A second-channel rule for any request that moves money or changes access.

A penetration test and a phishing simulation reveal whether your domain can be spoofed and whether people fall for it.