Quick Answer
Forging the sender address so an email appears to come from someone it didn't. The attacker needs no access to the real account — they simply write someone else's name on the envelope.
Spoofing vs. Lookalike Domains
Two different attacks that get confused, and the difference decides whether your defences work.
Spoofing forges your actual domain. An email claiming to be from finance@yourcompany.com that your systems never sent. SPF, DKIM, and DMARC stop this — with DMARC set to reject, these messages are refused before delivery.
Lookalike domains are registered by the attacker: yourc0mpany.com, or yourcompany-invoices.com. These are genuine domains they own, so they pass every authentication check. DMARC does nothing about them, because nothing is being forged.
Email authentication protects your domain from being impersonated. It doesn't stop someone registering one that looks like it.
How to Spot One
Unusual requests — payments, gift cards, changes to bank details, credential resets
Urgency — pressure to act before checking
Slightly wrong addresses — a substituted character, an extra word, a different suffix
A changed reply-to — display name looks right, replies go elsewhere
Tone that doesn't fit — different phrasing, formatting, or signature from previous messages
Unexpected attachments or links
The reliable defence is procedural: verify any payment or bank detail change by phone, on a number you already hold, never one from the email.
Example Scenario
A 110-person manufacturer received an email appearing to come from its CFO, requesting an urgent transfer to a new supplier account. It used the CFO's name and the company domain, but failed authentication and was quarantined before reaching finance. Payment verification procedures were added afterwards as a second line of defence.
How PureStack Stops Domain Impersonation
We configure SPF, DKIM, and DMARC to enforcement, deploy impersonation detection for lookalike domains, and help you put verification steps around payment requests.