What is email spoofing?

Spoofing is sending mail that claims to be from your domain when it is not. It costs an attacker nothing unless you have stopped it:

• The From address is just text - nothing in the mail protocol verifies it by default.
• SPF, DKIM and DMARC are the verification layer - they are what let a receiver reject the forgery.
• It is the setup for invoice fraud - a convincing message from your own domain to your own customers.

An enforcing DMARC policy is the single control that stops straightforward spoofing of your domain.