How To: Spot Email Spoofing

In short. Spoofing forges the visible From line so mail looks like your bank, your boss, or IT. The receiving server still records who handed it over.

Two “from” addresses

• Return-Path (envelope / MAIL FROM) — who actually handed the message over.
• From — the line people see. Anyone can write helpdesk@conglomcorp.com there.

That does not mean Conglomcorp’s servers sent it. The envelope might be reset@conglomcorp-it-help.example.

Related tricks:

• Display-name spoofing — a familiar name, any address.
• Domain spoofing — a forged @conglomcorp.com.
• Lookalike domains — a real different host, e.g. mer1dian-alerts.example.

DMARC is what ties authentication to the visible From. If the domain has no record, or publishes p=none, a spoof can still land. Filters help; they are not a guarantee.

Example

A prize email can show:

• From: "Conglomcorp Rewards" <rewards@conglomcorp.com>
• Return-Path: winner@claim-prize-now.example
• Reply-To: prizes@claim-prize-now.example
• Authentication-Results: spf=fail; dkim=fail; dmarc=fail

The chip says Conglomcorp. The envelope does not. Quarantine it.

In the simulator

• Pull Email headers on any hostile message. You will see that pattern.
• Genuine mail keeps From, Return-Path and Reply-To on the same organisation, with pass results.