Domain abuse

What is email spoofing?

Why a message can appear to come from a business that did not send it.

Trust in the From address

Recipients often judge a message by the display name and visible From domain. Attackers exploit that familiar identity to make requests, invoices or instructions more believable.

Domain authentication

SPF and DKIM provide authentication signals. DMARC aligns those signals with the visible domain and publishes a policy for failures.

Lookalike domains are a related but different problem: the attacker registers another domain that merely resembles the real one.