Topic starter
11/07/2026 8:48 pm
TL;DR: Spoofing is increasingly used to impersonate trusted senders, systems and brands across email, DNS, voice and SMS, with AI making deception more convincing and scalable, according to GlobalSign. The security problem is no longer just fraudulent messages, but trust infrastructure that assumes legitimacy instead of continuously verifying it.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Ataques de Spoofing explicados: tipos, riesgos y cómo detenerlos”.
Key questions
Q: What breaks when organisations rely on message appearance to establish trust?
A: When appearance is the main trust signal, attackers can impersonate executives, suppliers or brands well enough to trigger action before anyone verifies authenticity.
Q: Why do spoofing attacks keep working even when users are trained?
A: Training helps, but spoofing still works because attackers exploit moments when people must make fast trust decisions.
Q: How should security teams reduce spoofing risk in email and voice workflows?
A: Security teams should validate identity at the protocol edge, not rely on what the user sees in the interface.
Practitioner guidance
- Enforce domain authentication for outbound email Deploy SPF, DKIM and DMARC together, then move policy toward quarantine or reject for unauthenticated messages that claim to represent your organisation.
- Harden DNS trust paths Enable DNSSEC where critical, review resolver and caching behaviour, and monitor for unexpected changes in authoritative records or redirection patterns.
- Add out-of-band verification for high-risk requests Require a second trusted channel for payment changes, credential resets and executive approvals so message realism alone cannot trigger action.
Bottom line: Spoofing is eroding trust because it turns familiar-looking messages, names and routes into tools for fraud, credential theft and redirection.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:14 pm
Spoofing is now a trust governance failure, not a perimeter issue: the decisive weakness is the assumption that familiar-looking messages, domains or voices can be trusted until proven otherwise. That assumption collapses across email, DNS and AI-generated content because legitimacy can be copied faster than it can be manually reviewed. Practitioners need to treat trust verification as an explicit control plane, not a user judgement problem.
A question worth separating out:
A: Treat synthetic content as an identity verification problem, not just a content moderation issue. Require call-back procedures, approval segregation and secondary validation for sensitive requests, especially those involving payments, credentials or urgent exceptions. If the process can be completed solely through persuasive messaging, it is too easy to spoof.
👉 Read our full editorial: Spoofing is eroding trust across email, DNS and AI workflows