Why does email spoofing remain effective when SPF and DKIM exist?

Email spoofing remains effective because many domains only partially deploy authentication, and receiving systems often fail open when DMARC is missing or set weakly. SPF alone does not cover all delivery paths, DKIM can be absent or misconfigured, and without DMARC the receiver lacks clear enforcement guidance. The result is that forged messages can still reach inboxes that should have blocked them.

Why SPF and DKIM do not stop every spoofed email

SPF and DKIM are valuable, but they are only two signals in a broader email authentication chain. SPF checks sending infrastructure, not the full message path, and DKIM only helps when a domain signs consistently and the signature survives transit. A forged message can still look credible when policy is incomplete, alignment is weak, or the receiver does not enforce a stronger policy layer.

The practical problem is that email authentication is often deployed unevenly across domains, subdomains, and third-party senders. Large delivery ecosystems also include forwarded mail, mailing lists, shared services, and delegated senders, which can create edge cases where authentication results are ambiguous or are treated too leniently by receivers.

That is why spoofing can remain effective even when a domain publishes SPF and DKIM records. Authentication alone does not automatically tell the receiver what to do with a failure, and it does not guarantee that every lookalike message will be rejected. For that reason, domains that care about impersonation usually need a policy layer that closes the enforcement gap, as described in NHIMG’s Email Identity and BEC Guide.

Where spoofing still gets through in real mail flows

The most common failure mode is partial deployment. A domain may publish SPF and DKIM, but not apply DMARC, or apply it in a monitoring-only posture. In that case, a receiving platform may authenticate the message but still deliver it because there is no clear policy to reject or quarantine messages that fail alignment.

Another common gap is path coverage. SPF evaluates the sending IP against the domain’s authorized senders, but it does not prove that the visible “From” domain is the one actually being used for abuse. DKIM is stronger for message integrity, yet it depends on correct signing and selector management, and it can be broken by downstream modification or simply missing from some outbound streams.

Third-party mail services add complexity. If marketing platforms, ticketing tools, payroll systems, or invoice portals send on behalf of a domain, every sending path has to be inventoried and aligned. A single unmanaged sender can leave enough room for attacker-crafted messages to blend into normal mail traffic. That is one reason email identity failures often sit beside broader credential abuse problems, as shown in the TruffleNet stolen AWS keys campaign 2025.

Why receiver behavior matters as much as sender records

Email authentication only works when the receiving system treats it as an enforcement control, not just a diagnostic signal. If the receiver is configured to be permissive, then spoofed messages can still be delivered even when they should have been challenged or blocked. This is especially true when organizations rely on display-name cues, domain similarity, or user judgment instead of strict policy enforcement.

In practice, the receiver has to decide what to do with a message that claims to be from the protected domain but does not fully satisfy the authentication and alignment checks. Without that decision point, SPF and DKIM can reduce abuse but still leave room for delivery of forged mail. That is why authentication records should be treated as part of an enforcement model, not as proof that spoofing is solved.

For teams evaluating email trust controls, the relevant question is not whether SPF or DKIM exists in DNS, but whether the receiving environment consistently uses them to make a blocking decision. If the answer is no, spoofing remains a live delivery path.

Risk and Threat Considerations

email spoofing remains attractive because it exploits a gap between technical authentication and human trust. Attackers do not need to defeat every control; they only need one plausible message to reach a mailbox and trigger payment fraud, credential capture, or internal escalation.

Failure mechanism: Partial sender authentication, missing DMARC enforcement, forwarding edge cases, and permissive receiver policy let forged messages survive long enough to be acted on.

Impact: The result can be invoice fraud, account compromise, and broader business email compromise, especially when recipients trust the visible sender more than the underlying authentication result.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP API Security Top 10 addresses the attack surface, NIST SP 800-53 Rev 5 sets the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
OWASP API Security Top 10	API2 — Broken Authentication	Email spoofing exploits weak or incomplete authentication of sender identity.
Recommendation — Require authenticated sender paths and reject mail that fails identity validation.
NIST SP 800-53 Rev 5	IA-2 — Identification and Authentication (Organizational Users)	Spoofing persists when sender authentication is incomplete or inconsistently enforced.
	IA-9 — Service Identification and Authentication	Mail services and delegated senders must authenticate correctly to prevent forged delivery paths.
	AC-6 — Least Privilege	Overly permissive mail services increase spoofing and abuse blast radius.
Recommendation — Enforce strong authentication for authorized sending systems and block unauthenticated sources. Authenticate service senders and verify that each outbound path is explicitly authorized. Limit mail-sending privileges to only the services and domains that need them.
ISO/IEC 27001:2022	A.5.15 — Access control	Email spoofing is reduced when sender authorization and enforcement are governed consistently.
Recommendation — Define and enforce sender authorization rules for every approved mail source.

Practitioner Guidance

What to verify: Confirm that every legitimate outbound path is inventoried, aligned, and signed consistently. If a business system sends mail on your behalf but is not covered by the same policy, treat that as a gap rather than an exception to ignore.

Decision rule: If you can only describe your email posture in terms of SPF and DKIM presence, you probably do not have enough enforcement visibility. The more useful test is whether unauthenticated or misaligned mail is rejected, quarantined, or left to user judgment.

What good looks like: The domain has consistent alignment, DMARC enforcement is active, and receivers have a clear, repeatable action for failures. That combination matters more than record existence alone.

Practitioner takeaway: Spoofing stays effective whenever authentication is treated as evidence instead of policy. The defensive objective is to make forged mail fail closed at the receiver, not merely to prove that some parts of the message path are authenticated.