Email spoofing is forging the 'From' address on a message so it appears to come from a domain the sender doesn't control, the exact attack SPF, DKIM, and DMARC exist to let a receiving server detect and stop.
Spoofing is simple to describe and used to be simple to pull off: put someone else's domain in the "From" field and send. Before authentication standards existed, a receiving mail server had no reliable way to tell a spoofed message from a real one, since the visible sender address was never verified against anything. That gap is exactly what SPF, DKIM, and DMARC were built to close: one checking which servers are allowed to send for a domain, one signing the message so tampering shows up, one telling the receiver what to do when a message fails either check.
A domain with real customers and no cold outbound running on it still needs DMARC, because leaving it unprotected is an open invitation for someone else to spoof it in a phishing run aimed at that company's own customers or partners. A cold-sending subdomain is a lower-stakes case for a different reason: there's rarely any legitimate mail flow on it worth protecting from spoofing the way there is on a corporate domain, which is why most cold-sending subdomains sit at a DMARC policy well short of full rejection, and it costs them nothing to do it.
Checking whether a domain is exposed is quick: look up its DMARC record and see if one exists at all, and if it does, what policy it enforces. No record means no protection. A p=none record means monitoring only, spoofed mail still gets through, just gets reported.
People assume spoofing is mainly a risk to the recipient, someone getting tricked by a fake email. It's just as much a risk to the domain being impersonated, since a spoofing campaign run under a company's name can damage that domain's reputation with mailbox providers even though the company never sent a single one of those messages.
Tell us how your motion runs today. We'll show you what we'd engineer.
Contact us