What email spoofing actually is
Email spoofing is the practice of forging the sender address on an email to make it appear to come from someone it does not. It does not require hacking an account. An attacker can put any name and any address in the From field using standard mail tools. The email arrives looking exactly as if it came from your bank, your CEO, or a trusted supplier. Nothing in the message itself reveals that the sender address is fake. This is the foundation of most phishing attacks, business email compromise scams, and supplier fraud.
How it works technically
When an email is sent, there are two separate sender addresses in play. The envelope sender is used by mail servers to route the message and handle bounces. The header From address is what you see in your inbox. These two do not have to match. An attacker sets the header From to whatever they want, a legitimate-looking address and all, while the envelope sender points somewhere entirely different. Your inbox displays the header From. Your spam filter, unless specifically configured to check the alignment, may never notice the difference.
What SPF, DKIM, and DMARC actually do
SPF records tell receiving mail servers which IP addresses are allowed to send mail on behalf of your domain. DKIM adds a cryptographic signature to outgoing emails so receivers can verify the message was not tampered with in transit. DMARC builds on both: it tells receivers what to do when SPF or DKIM checks fail, and whether the visible From address aligns with the domain that passed those checks. Together, these three standards make it significantly harder for others to spoof your domain when sending to people outside your organisation.
What they do not stop
SPF, DKIM, and DMARC protect your domain from being spoofed by others. They do not protect you from receiving emails that spoof someone else. If an attacker wants to impersonate your supplier, they can use the supplier's domain before DMARC is enforced there, register a lookalike domain (suppliercompany.net instead of suppliercompany.com), or use a legitimate mail service to send from a real but unrelated address with a convincing display name. DMARC at your own domain does nothing in these cases. The email arrives, passes all checks, and lands in your inbox looking exactly like it came from someone you trust.
What a gateway layer adds
A gateway sees patterns that auth records cannot. It tracks the sending history of the infrastructure behind each email, scores the reputation of the ASN the message originated from, checks whether the sending behaviour matches a legitimate organisation or a newly provisioned attack domain, and flags display name spoofing where the visible name matches a known contact but the underlying domain does not. Auth records verify that an email is technically authorised. A gateway can assess whether the sender behind those records has behaved like a real organisation, or whether this is the first time this infrastructure has sent anything to anyone.