Email spoofing
Forging the sender identity on a message. SMTP verifies neither the envelope sender nor the visible From, so the three forms differ in whether authentication can address them at all.
Email spoofing is forging the identity a message appears to come from.
It is possible because SMTP was specified for delivery and never for
verification: the sender writes both the envelope sender used for routing
and the From: header a recipient reads, and nothing in the original
design checks either. Every control in this area was added afterwards, on
top of DNS, rather than by changing the protocol.
Three forms are worth telling apart, because they call for different
answers. Exact-domain spoofing forges the real domain in the From:
header, and is the one DMARC at p=reject genuinely
blocks. Lookalike or cousin domains use a name close enough to fool a
reader, and they authenticate flawlessly because the attacker owns them
and publishes their own SPF and DKIM
records, so the target’s records are never even consulted. Display-name
spoofing puts a trusted person’s name in the friendly-name portion while
the address beside it is unrelated, which is especially effective on
phones, where many clients show only the name. A compromised mailbox is a
fourth case and not spoofing at all: the mail genuinely is what it claims
to be.
Exam relevance: match the form to the control. Only exact-domain spoofing is addressed by email authentication, and only at enforcement. Lookalike domains call for brand monitoring and awareness, display-name spoofing for client configuration and awareness, and account takeover for phishing-resistant multi-factor authentication and incident response. A scenario where every check passes and the mail is still malicious is describing one of the last three.