====== Email Spoofing ======

**Email Spoofing** is a security threat where a sender forge or manipulates the headers of an email message so that it appears to originate from a legitimate, trusted sender or domain.

Spoofing is frequently used in [[email:security:phishing|Phishing]] campaigns, Business Email Compromise (BEC) attacks, and mass [[email:security:spam|Spam]] distribution to bypass user suspicion and trick recipients into trusting the email content.

----

===== How Email Spoofing Works =====

The Simple Mail Transfer Protocol (SMTP) was originally designed without built-in identity verification mechanism. In a basic SMTP transaction, the sending server specifies two different "From" addresses:

  # **Envelope From (`MAIL FROM`):** Used by mail servers for delivery and returning bounce messages ([[email:troubleshooting:bounces|NDRs]]).
  # **Header From (`From:`):** Displayed to the end user in their email client inbox interface.

An attacker can easily connect to an SMTP server and inject any arbitrary address into the `From:` header field unless the domain owner explicitly enforces authentication policies.

<code>
HELO attacker-server.com
MAIL FROM: <spammer@evil.com>
RCPT TO: <victim@target.com>
DATA
From: "CEO Name" <ceo@telenegar.ir>   <-- FORGED HEADER DISPLAYED TO USER
To: victim@target.com
Subject: Urgent Wire Transfer Request
...
</code>

----

===== Types of Email Spoofing =====

^ Spoofing Method ^ Mechanism ^ Example ^
| **Exact-Domain Spoofing** | The attacker uses the exact legitimate domain name in the `From:` header without authorization. | `admin@telenegar.ir` |
| **Lookalike / Cousin Domain** | The attacker registers a domain visually similar to the target brand (typosquatting). | `admin@telenegat.ir` |
| **Display Name Spoofing** | The attacker uses a legitimate display name paired with an unrelated, rogue email address. | `"Telenegar Support" <attacker123@gmail.com>` |

----

===== Technical Countermeasures against Spoofing =====

Defending against exact-domain spoofing requires implementing the three core DNS email authentication standards:

==== 1. SPF (Sender Policy Framework) ====
Publish an [[email:dns-configuration:spf|SPF Record]] in your domain's DNS zone to explicitly list the authorized IP addresses and mail servers allowed to send email on behalf of your domain.

==== 2. DKIM (DomainKeys Identified Mail) ====
Configure [[email:dns-configuration:dkim|DKIM Signatures]] to append a cryptographic signature to outbound messages. The receiving server validates the signature using the domain's public key published in DNS, ensuring the message was not modified in transit.

==== 3. DMARC (Domain-based Message Authentication) ====
[[email:dns-configuration:dmarc|DMARC]] ties SPF and DKIM together. It enforces **domain alignment** (requiring the domain in the `From:` header to match the SPF and/or DKIM domains) and specifies what action receiving servers must take if an unauthenticated message is detected:

  * `p=none` — Monitor and collect reports without blocking.
  * `p=quarantine` — Send failing emails directly to the recipient's Spam folder.
  * `p=reject` — Explicitly reject failing emails at the gateway level (**complete protection against exact-domain spoofing**).

----

===== Detecting Spoofing via Headers =====

Receiving security systems and administrators can identify spoofed emails by analyzing raw [[email:troubleshooting:mail-headers|Email Headers]]:

  * **Authentication-Results:** Look for `spf=fail`, `dkim=fail`, or `dmarc=fail` flags.
  * **Received Trace:** Inspect the lowest `Received:` header to determine the true originating IP address of the message.
  * **Envelope Alignment:** Compare the `Return-Path:` address with the header `From:` address.

----

===== Verification & Diagnostics with Telenegar =====

Audit your domain's resistance against email spoofing using **Telenegar Tools**:

==== Using Telenegar Tools ====
  * **Spoofing Vulnerability Scan:** Test your domain's SPF, DKIM, and DMARC enforcement with the [[tools:mailcheck|Telenegar Mail Check Tool]].
  * **Authentication DNS Check:** Inspect your published security TXT records globally via the [[tools:dnscheck|Telenegar DNS Check Tool]].

----

===== Related Documentation =====

  * [[tools:mailcheck|Telenegar Mail Check Tool]] — Diagnostic tool for email spoofing protection and security health.
  * [[tools:dnscheck|Telenegar DNS Check Tool]] — Diagnostic tool for DNS record resolution and lookup.
  * [[email:dns-configuration:dmarc|DMARC]] — Primary mechanism for preventing exact-domain spoofing.
  * [[email:dns-configuration:spf|SPF]] & [[email:dns-configuration:dkim|DKIM]] — Core authentication mechanisms required for DMARC.
  * [[email:dns-configuration:bimi|BIMI]] — Visual verification mechanism for authenticated domain brands.
  * [[email:security:phishing|Phishing]] — Social engineering attacks leveraging spoofing.
  * [[email:security:spam|Spam]] — Mass email campaigns utilizing forged sender identities.
  * [[email:troubleshooting:mail-headers|Email Headers]] — Learn how to parse headers to identify spoofed emails.