Notifications
Clear all
Topic starter
11/07/2026 8:48 pm
TL;DR: Spoofing is increasingly used to impersonate trusted senders, systems and brands across email, DNS, voice and SMS, with AI making deception more convincing and scalable, according to GlobalSign. The security problem is no longer just fraudulent messages, but trust infrastructure that assumes legitimacy instead of continuously verifying it.
NHIMG editorial — based on content published by GlobalSign: El spoofing merece tu atención
Questions worth separating out
Q: What breaks when spoofing controls are not enforced consistently?
A: When spoofing controls are inconsistent, attackers can present forged identities that look legitimate enough to trigger payment, credential entry or redirection.
Q: Why do spoofing attacks keep working even when users are trained?
A: Training helps, but spoofing still works because attackers exploit moments when people must make fast trust decisions.
Q: How can security teams measure whether spoofing defences are effective?
A: Look for declining DMARC failures, fewer successful phishing and BEC incidents, lower false acceptance rates in verification workflows, and faster detection of suspicious DNS redirection.
Practitioner guidance
- Enforce domain authentication for outbound mail Deploy SPF, DKIM and DMARC together, then move DMARC policy to reject for domains that send business-critical mail.
- Add secondary verification to high-risk requests Require a separate verification step for payment changes, credential resets and privileged access requests, especially when the request arrives by email, phone or chat.
- Harden DNS trust controls for critical domains Use DNSSEC where it is operationally viable and monitor for unexpected resolver changes, record drift and suspicious redirections on customer-facing and authentication domains.
What's in the full article
GlobalSign's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step explanations of SPF, DKIM, DMARC and DNSSEC deployment for teams implementing mail and domain controls.
- Practical guidance on BIMI and Verified Mark Certificates for brands that want to strengthen authenticated email presentation.
- Examples of layered anti-spoofing controls across email, DNS, mobile, voice and web channels.
- Recommendations for incident response and user-awareness programmes tailored to spoofing and impersonation attacks.
👉 Read GlobalSign's analysis of spoofing risks, controls and AI-driven impersonation →
Spoofing, trust abuse and what security teams need to fix?
Explore further
11/07/2026 9:14 pm
Spoofing is a trust-layer failure before it is a content-layer attack. The article correctly treats email, DNS, voice and website impersonation as variations of the same governance problem: decision-makers are being asked to trust a claim that has not been independently verified. For IAM and fraud teams, that means trust signals must be anchored in identity assurance and channel validation, not familiarity alone.
A question worth separating out:
Q: Who is accountable when spoofing leads to fraud or compromise?
A: Accountability usually spans the team that owns the channel, the team that defines the workflow and the team that approves the action. If a process accepts unvalidated identity signals, the control owner failed to define the trust boundary clearly enough. Governance should assign ownership to the signal and the decision point.
👉 Read our full editorial: Spoofing is eroding trust across email, DNS and AI workflows
