What Is Domain Spoofing? Exact-Domain vs Look-Alike Attacks

Q: What is the difference between domain spoofing and email spoofing?

Email spoofing is one type of domain spoofing — specifically, forging a domain in the From header of an email. Domain spoofing is the broader category that also includes look-alike domains, website cloning, and DNS spoofing. Put simply: all email spoofing is domain spoofing, but not all domain spoofing is email spoofing. When people ask "can my domain be spoofed in email?" they are asking about the exact-domain form, which is governed entirely by your SPF, DKIM, and DMARC records. For that specific deep dive, see email spoofing explained.

Published 2026-08-21

Domain spoofing is any attack that makes an email, a website, or a DNS answer appear to come from a domain the sender does not actually control. It is not one technique but a family of them: forging your exact domain in an email’s From header, registering a look-alike domain that reads almost identically, cloning your website, or poisoning the DNS that points visitors to you. The most preventable of these is exact-domain email forgery — and the August 2026 defaults.exposed census shows how few domains prevent it. Of the domains that bother to publish an SPF record, 56.4% — 82,539,695 — use a “soft-fail” setting that tells receiving servers to flag a forgery but deliver it anyway. Soft-fail is the setting that looks like protection and is not. This guide separates the four faces of domain spoofing, explains which ones you can close and which you can only monitor, and shows you how to check your own domain for free.

If you have ever wondered whether a criminal could send email that appears to come from your business, or stand up a website on a domain a customer would mistake for yours, the answer for most organisations is the same: yes, and usually with no warning. The figures throughout come from the defaults.exposed August 2026 census, an independent scan of 432,127,908 domains graded as of 2026-08-16. Where a statistic describes email authentication it is measured against the 376,928,750 domains graded for it.

What Is Domain Spoofing?

Domain spoofing is the act of impersonating a domain — yours — to make a message or destination look trustworthy when it is not. The attacker’s goal is almost always the same: borrow the credibility your domain has earned so a recipient lowers their guard and does something they would not do for a stranger. Pay an invoice. Enter a password. Approve a wire. Click a link.

What makes “domain spoofing” a broad term rather than a single exploit is that a domain shows up in several places a victim can see, and each one can be faked by a different method:

The From address of an email — forged by putting your exact domain in the header (exact-domain spoofing).
A domain that merely resembles yours — a separate, attacker-owned domain built to be misread (look-alike or “cousin” domain spoofing).
The website a link leads to — a cloned or intercepted page that presents itself as your site (website spoofing).
The DNS answer that resolves your name — tampered with so your domain points at attacker infrastructure (DNS spoofing).

Two of these — exact-domain email forgery and DNS spoofing — abuse your domain directly, and you can shut them down with configuration you control. The other two — look-alike domains and cloned websites — happen on infrastructure the attacker owns, so you cannot switch them off; you can only detect them and respond. Knowing which category an attack falls into is the difference between a fix and a fire drill.

Exact-Domain Spoofing vs Look-Alike (Cousin) Domains

The single most useful distinction in this whole topic is between forging your exact domain and registering a look-alike one. They feel similar to a victim and are completely different to a defender.

Exact-domain spoofing uses your real domain, character for character. An email arrives with From: [email protected] — the genuine string — even though it never touched your mail servers. This is possible because the From header a human reads is just text the sender types; nothing about the email protocol forces it to match where the mail actually came from. The only thing that stops it is a published, enforcing email-authentication policy on your domain, which instructs receiving servers to reject mail that claims to be you but cannot prove it. Because it reuses your exact domain, this attack costs the criminal nothing — no registration, no lookalike, no waiting. It is the cheapest impersonation there is, and the census shows it is available against the overwhelming majority of domains. For the mechanics of how the forgery is constructed and why it passes, see email spoofing explained.

Look-alike (cousin) domain spoofing is the opposite: the attacker cannot use your exact domain, so they register a different one that reads almost identically and send from that. Crucially, this domain belongs to the attacker, who can publish perfect SPF, DKIM, and DMARC on it. Their mail passes every authentication check — because it is authentically their forgery domain. Your own email-authentication policy is irrelevant here; you have no control over a domain you do not own. Look-alikes come in several recognisable shapes:

Typosquats — a plausible fat-finger of your name: yourbusines.com (dropped letter), yuorbusiness.com (transposed), yourbussiness.com (doubled).
Homograph / IDN spoofs — characters from another script that render identically, such as a Cyrillic “а” standing in for the Latin “a”, producing a domain that is visually indistinguishable from yours.
Combosquats — your real name plus a reassuring word: yourbusiness-support.com, secure-yourbusiness.com, yourbusiness-billing.com. These are the most common in practice because they read as legitimate sub-brands.
TLD swaps — your exact name under a different extension: yourbusiness.co instead of .com, or a country or novelty TLD you never registered.

The defensive consequence is stark. Enforcing DMARC on yourbusiness.com does nothing to stop mail from yourbusiness-billing.com — that is a wholly separate domain with its own valid records. Exact-domain forgery you close; look-alike domains you watch for. This is exactly the line where a free authentication check ends and continuous monitoring begins, a point we return to in the prevention section.

How Attackers Forge Your Exact Domain: the Enforcement Gap

The exact-domain half of the problem has a precise, well-understood cause, and it is worth stating plainly because it is the part you can fix today. Email carries two “from” identities: the hidden envelope sender that mail servers use to route and bounce messages, and the visible From: header that the recipient’s mail client displays. An attacker can set these to two different domains — pass authentication for a throwaway domain in the envelope, while displaying your domain in the header the human actually reads.

Three DNS records decide whether that trick works:

SPF (Sender Policy Framework) lists which servers may send for your domain — but it validates the envelope, not the visible From. On its own it never sees the address the recipient reads.
DKIM attaches a cryptographic signature proving a message was authorised by some domain — but not necessarily the one displayed.
DMARC is the record that ties it together. It requires that a domain which passes SPF or DKIM is aligned with the visible From domain, and it tells receivers what to do when nothing aligns: monitor (p=none), quarantine, or reject.

Exact-domain forgery succeeds whenever DMARC is absent or set to p=none, because then no receiver has been instructed to refuse the unaligned mail. We keep this section deliberately short because the full construction — headers, alignment, why “SPF passes” is not “DMARC passes” — is covered in detail in email spoofing explained and in the DMARC explainer. What matters for the umbrella view is this: exact-domain forgery is a default-configuration failure, and the census measures precisely how common that default is.

What the Census Shows: Soft-Fail SPF Does Not Help

Here is where the numbers change the conversation. Most domains that have made any effort at email authentication have published an SPF record — and then chosen the version of it that does not enforce.

An SPF record ends with an instruction telling receivers what to do with mail from servers the record does not list. There are two meaningful choices:

-all (hard-fail) — “reject anything not on this list.” This is enforcement.
~all (soft-fail) — “accept it, but mark it as suspicious.” This is a suggestion.

Across the census, 56.4% of all SPF publishers — 82,539,695 domains — end their record with the soft-fail ~all, against just 38.4% (56,268,491) that use the enforcing -all. Soft-fail is the single most common email-security setting on the internet that reads as protection while providing almost none: a forged message from an unlisted server still lands, merely flagged, and flags are routinely ignored by both filters and humans. The full breakdown of why so many domains settle for the weaker setting is in our twin report, SPF hard-fail vs soft-fail, and the grading logic sits in the SPF policy strength methodology.

But even a hard-fail SPF record does not, by itself, stop exact-domain spoofing — because SPF checks the invisible envelope, not the From your recipient sees. That last gap is DMARC’s job, and DMARC is where the exposure becomes near-total. Of the 376,928,750 domains graded, 90.7% — 341,945,132 — publish no enforcing DMARC policy at all, which means a forged message wearing their exact domain in the From line has nothing standing in its way. Only 2.9% (10,902,284) carry the full stack — SPF, DKIM, and an enforcing DMARC — that closes the exact-domain door completely. And 56.8% (214,276,774) publish neither SPF nor DMARC, offering not even the soft-fail illusion of a posture. The grading for the enforcement decision is documented in the DMARC policy methodology.

The takeaway for exact-domain spoofing: publishing a record is not the same as being protected. A domain can have SPF, feel covered, and still be forged freely — because it chose soft-fail, or never added the DMARC layer that soft-fail can never substitute for.

Website and DNS Spoofing: the Other Faces of the Attack

Email is the loudest channel, but the same word — spoofing — covers two attacks on the destinations a domain resolves to.

Website spoofing is a fake page dressed as your real one. It arrives two ways. The common way rides a look-alike domain: the cloned login or checkout page is hosted on yourbusiness-secure.com, and the URL bar tells the truth to anyone who reads it closely — which few do. The more technical way exploits a site that is reachable over plain, unencrypted HTTP, where a network attacker between the visitor and the server can alter the page in transit or present a substitute. This is why encryption everywhere matters: a site that answers on HTTP and never forces a redirect to HTTPS leaves that interception window open. The census still finds 44 million domains serving plain HTTP with no TLS at all, and the grading for transport security lives in the HTTPS-available methodology. A valid, current certificate — see certificate validity — is what lets a visitor confirm the site is the one it claims to be.

DNS spoofing attacks the layer beneath both. DNS is the lookup that turns yourbusiness.com into an address; if an attacker can inject a false answer into a resolver’s cache (cache poisoning) or otherwise tamper with the response, visitors typing your correct domain are silently routed to attacker infrastructure — no look-alike required, no typo needed. The defence is DNSSEC, which cryptographically signs DNS answers so a resolver can reject forged ones. Adoption is thin, and where it exists it is often broken: the census found 157,064 domains whose DNSSEC is present but fails validation, documented in broken DNSSEC: 157,064 domains are invisibly down, with grading in the DNSSEC DS methodology. DNS spoofing is rarer than email forgery and harder to pull off, but it is the highest-leverage form when it succeeds, because it subverts the exact domain without touching the From header or registering anything at all.

The pattern across all four faces is consistent: the attacks that abuse your domain (exact-domain email, DNS) are the ones you can close with configuration; the attacks that stand up their own infrastructure (look-alikes, cloned sites) are the ones you can only detect early.

How to Prevent Domain Spoofing

Prevention splits along the same line as the attacks. Some of this is a one-afternoon configuration job; some of it is an ongoing watch.

Close exact-domain email forgery — the highest-value, most fixable step.

Publish SPF and end it with -all, not ~all. If your record already exists but ends in soft-fail, changing that one token moves you from the 56.4% who suggest to the 38.4% who enforce. Confirm every legitimate sender is listed first so you do not block your own mail.
Enable DKIM on every service that sends as you, so your mail carries a signature aligned with your domain.
Publish DMARC and drive it to p=reject. Start at p=none with a reporting address, read the aggregate reports for two to four weeks to confirm your real senders align, then tighten to p=quarantine and finally p=reject at pct=100 with a matching sp=reject for subdomains. This is the step that actually stops the forgery; the sequence and the DMARC explainer walk through it without breaking legitimate mail.

Harden the destinations.

Force HTTPS and add HSTS so no visitor is ever served your site over interceptable plain HTTP.
Enable DNSSEC (and verify it actually validates) so forged DNS answers are rejected rather than cached.

Monitor for what you cannot switch off.

Watch for look-alike domains. Because cousin domains live on infrastructure you do not own, no record on your side removes them — the defence is early detection: monitoring new registrations that resemble your brand, common typos, homograph variants, and combosquats, so you can act (takedown, warning, blocking) before a campaign lands on your customers. This is the layer a one-time authentication check cannot see, and where ongoing monitoring earns its place — see how the fix and monitoring work.

The reason to start with the email steps is leverage: they are free, they take an afternoon, and they close the cheapest and most common attack. Business email compromise — the fraud that rides exactly this gap — is built on it end to end, as we set out in what is business email compromise and in invoice fraud prevention.

Is Your Domain Spoofable? Run a Free Check

You do not have to guess which of these gaps is open on your domain. A scan reads your published records the same way a receiving mail server — or an attacker sizing you up — would.

Check your domain free at defaults.exposed — it reads your live SPF, DKIM, and DMARC straight from public DNS and tells you whether your exact domain can be forged: whether your SPF enforces or soft-fails, whether DMARC is present and set to reject, and whether the pieces align. It takes about 30 seconds and needs no account. The free check answers the exact-domain question directly; closing the gaps for good — and adding monitoring for the look-alike domains a one-time check cannot see — is where the paid fix comes in.

What This Means

For business owners, domain spoofing is not an abstract IT risk — it is the mechanism behind the fake-invoice and fake-executive emails that drain real money, and the counterfeit websites that harvest your customers’ logins. The most common version, exact-domain email forgery, is available against 90.7% of domains and costs the criminal nothing. The fix is free and takes an afternoon. Leaving SPF on soft-fail or DMARC unset is, in practice, a decision to let anyone send email as you.

For IT and security teams, the umbrella view matters: do not let “we have SPF” stand in for “we are protected.” Soft-fail SPF is the 56.4% trap — a record that reads green and enforces nothing. Enforcement means -all on SPF, p=reject on DMARC with an aligned subdomain policy, HSTS on the web tier, and validating DNSSEC beneath. And because look-alike domains sit outside your control entirely, treat detection of cousin registrations as a standing control, not a project.

FAQ

What is domain spoofing? Domain spoofing is any attack that impersonates a domain to make a message or website look trustworthy. It is an umbrella term covering four distinct methods: forging your exact domain in an email’s From header, registering a look-alike (“cousin”) domain that reads almost identically, cloning your website, and tampering with the DNS answers that resolve your name. Two of these abuse your own domain and can be closed with configuration; two happen on attacker-owned infrastructure and can only be detected. The most common form — exact-domain email forgery — is available against 90.7% of the 376,928,750 domains graded in the August 2026 census.

How do you prevent domain spoofing? Prevention has three layers. First, close exact-domain email forgery: publish SPF ending in hard-fail -all (not soft-fail ~all), enable DKIM, and drive DMARC to p=reject after a monitoring period. Second, harden your destinations: force HTTPS with HSTS so pages cannot be intercepted, and enable validating DNSSEC so forged DNS answers are rejected. Third, monitor for look-alike domains, because cousin domains live on infrastructure you do not own and no setting on your side can remove them — early detection is the only defence. The census found only 2.9% (10,902,284) of domains have completed the first, most fixable layer.

What is the difference between domain spoofing and email spoofing? Email spoofing is one type of domain spoofing — specifically, forging a domain in the From header of an email. Domain spoofing is the broader category that also includes look-alike domains, website cloning, and DNS spoofing. Put simply: all email spoofing is domain spoofing, but not all domain spoofing is email spoofing. When people ask “can my domain be spoofed in email?” they are asking about the exact-domain form, which is governed entirely by your SPF, DKIM, and DMARC records. For that specific deep dive, see email spoofing explained.

Can someone spoof my domain? For most domains, yes — and cheaply. If your DMARC is absent or set to p=none, anyone can send email displaying your exact domain in the From line with no registration and no infrastructure; that describes 90.7% (341,945,132) of graded domains. Even domains with SPF are frequently exposed, because 56.4% of SPF publishers use a soft-fail that never blocks the forgery. Separately, a look-alike domain resembling yours can be registered by anyone at any time, regardless of your settings. The fastest way to know your exposure is to run the free check: Check your domain free at defaults.exposed — it reads your live records and tells you whether your exact domain can be forged.

Data to cite

“90.7% of domains (341,945,132 of 376,928,750 email-graded) can be exact-domain spoofed, because they publish no enforcing DMARC policy.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“56.4% of SPF publishers (82,539,695) end their record with a soft-fail (~all) that flags but does not block a forged message.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“38.4% of SPF publishers (56,268,491) use the enforcing hard-fail (-all) setting.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“Only 2.9% of domains (10,902,284) carry the full SPF, DKIM, and enforcing DMARC stack that closes exact-domain email spoofing.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“56.8% of domains (214,276,774) publish neither SPF nor DMARC, leaving no email-authentication posture at all.” — defaults.exposed August 2026 Domain Security Census (432M domains)

See where your own domain stands

Domain spoofing is only frightening while it is invisible. The moment you can see which faces of the attack are open on your domain, most of them become an afternoon’s configuration — and the one that is not, look-alike registration, becomes something you watch for deliberately instead of discovering after the fact.

Check your domain free at defaults.exposed — it reads your live SPF, DKIM, and DMARC records from public DNS and tells you instantly whether your exact domain can be forged, whether your SPF enforces or merely soft-fails, and whether DMARC is set to reject. Takes 30 seconds. No account needed. If you want the exact-domain gap closed properly and continuous monitoring for the look-alike domains a one-time check cannot cover, see how the fix works.

Read the flagship census report: The State of Domain Security 2026 →

Aggregate data only. Data stored and processed in the EU.

Data source: defaults.exposed August 2026 census, methodology v9, as of 2026-08-16. 376,928,750 domains graded for email authentication from 432,127,908 scanned. All figures are counts of graded domains. References: RFC 7489 (DMARC), RFC 7208 (SPF), RFC 6376 (DKIM), RFC 4033 (DNSSEC).

How to cite this report

Press / blog: defaults.exposed (2026). What Is Domain Spoofing? Exact-Domain vs Look-Alike Attacks. defaults.exposed August 2026 Domain Security Census (432,127,908 domains scanned, asOf 2026-08-16). Retrieved from https://defaults.exposed/v9/articles/what-is-domain-spoofing-exact-domain-vs-look-alike-attacks

Academic: defaults.exposed. (2026, August 21). What Is Domain Spoofing? Exact-Domain vs Look-Alike Attacks. In defaults.exposed Domain Security Census: August 2026. https://defaults.exposed/v9/articles/what-is-domain-spoofing-exact-domain-vs-look-alike-attacks

In-line citation: (defaults.exposed, August 2026 Domain Security Census, n=376,928,750 graded domains)

About the defaults.exposed August 2026 Census

The defaults.exposed Domain Security Census is a recurring independent measurement of the public domain namespace. The August 2026 edition scanned 432,127,908 domains between 1–16 August 2026 and graded 376,928,750 of them for email authentication using methodology v9. Scans are conducted from EU infrastructure. No individual domain, registrant, or business is named in any report. All figures are aggregate distributions. Data is stored and processed within the EU.

Methodology: defaults.exposed/v9/methodology Full census report: defaults.exposed/en/articles/the-state-of-domain-security-2026

Data sourced from the August 2026 grading methodology (v9) — 34 checks, 376 million domains. Browse the census statistics or the Census Explorer, or see all August 2026 research →