Definition
Domain Spoofing is a technique where attackers forge or impersonate a legitimate domain name in emails or websites to deceive users into believing they are interacting with a trusted entity.
People Also Ask
Common questions about Domain Spoofing answered by our security experts.
Domain Spoofing in Practice
Domain spoofing is forging the apparent origin of a message or website so it appears to come from a domain the attacker does not control. In email it is straightforward, because the protocol was designed without any concept of sender verification.
It differs from typosquatting, where a similar domain is genuinely registered. Here the real domain is claimed, which is why the countermeasures are authentication rather than monitoring.
The three email authentication mechanisms
Sender policy publishes which servers may send for your domain, so a message from elsewhere fails the check. Message signing adds a cryptographic signature that a recipient verifies against a published key, which also detects modification in transit.
Reporting and conformance policy ties the two together: it tells recipients what to do when a message fails, and it requires the visible sender address to align with what was authenticated. Without the third, the first two protect very little.
Publishing a policy that does nothing
The most common configuration is a conformance record set to take no action — monitor only. That produces reports and rejects nothing, and a great many organisations have sat in that state for years believing they are protected.
Moving to quarantine and then rejection is the step that provides the protection. It requires knowing every legitimate sender for your domain first, which is the work that keeps organisations in monitoring mode.
Finding your own senders
Marketing platforms, invoicing and ticketing systems, human resources tools, monitoring alerts, transactional mail from applications, and anything a department signed up for independently all send as your domain.
The reports generated in monitoring mode enumerate them, which is precisely what that mode is for. Treating it as a discovery phase with an end date, rather than a standing configuration, is the difference between progress and permanence.
Display name spoofing bypasses all of it
An attacker sending from their own authenticated domain, with the display name set to a colleague or executive, passes every check — because nothing is forged. Mail clients frequently show only the display name, particularly on mobile.
Clear external sender marking is what addresses this, since the message genuinely is external. It is one of the few controls that works on the reader rather than on the protocol.
Website and certificate spoofing
The web equivalent is largely handled by certificate validation, provided users notice warnings. Certificate transparency monitoring lets you detect certificates issued for your names without your knowledge.
Adding a certificate authority authorisation record, which states which authorities may issue for your domain, closes off a category of misissuance and takes minutes.
Dangling records and forgotten subdomains
A subdomain still resolving to a cloud resource that has been deleted can frequently be claimed by whoever registers that resource name next — giving them a genuine, certificated host on your domain, which defeats every check a recipient can make.
It happens through ordinary decommissioning: the resource is removed and the name record is not. Auditing your own name records for entries pointing at resources that no longer exist is a short exercise and it closes one of the few ways an outsider obtains a legitimate presence on your domain.
Where to start
Look up your own domain's conformance policy. If it is set to take no action, you are not protected against anyone impersonating your organisation to your customers.
See email security. GuardsArm runs security program reviews.
Related Terms
Phishing
Phishing is a social engineering attack where cybercriminals send fraudulent communications, typically emails, that appear to come from a trusted source. The goal is to trick recipients into revealing sensitive information, clicking malicious links, or downloading malware.
Typosquatting
Typosquatting is a social engineering attack that registers domain names similar to popular websites, exploiting common typing errors to redirect users to malicious sites for phishing, malware distribution, or ad fraud.
Business Email Compromise
Business Email Compromise (BEC) is a sophisticated scam targeting organizations that conduct wire transfers, where attackers impersonate executives or trusted partners via email to trick employees into transferring funds or sensitive data.
Related Reading
The $4.5 Million Email: How Phishing Still Owns Healthcare
Phishing remains healthcare's most expensive attack vector, not because staff are careless but because the attacks are sophisticated and the…
MFA Won't Save You: Why Token Theft Is Healthcare's Next Crisis
Attackers don't need your password anymore. They're stealing session tokens after MFA approval, and healthcare organizations running Microsoft 365…
Email Security for Healthcare: Stopping Business Email Compromise
Business email compromise carries no malware and defeats most filtering. How healthcare organisations enforce DMARC without breaking clinical mail…
Speak With an Expert
Book a free consultation to discuss domain spoofing for your organization.
Related Services
Need Help With Domain Spoofing?
Our certified security professionals can help you implement the right domain spoofing strategy for your organization. Get a free assessment today.
Book a Free Consultation