What is forged email?
Forged email is a message that shows a firm's real address in the From line without having been sent by the firm.
Last read from the sources at the foot of this page.
What does forged email mean?
Email on the Internet can be forged in a number of ways. In particular, existing protocols place no restriction on what a sending host can use as the "MAIL FROM" of a message or the domain given on the SMTP HELO/EHLO commands.
A forger needs no access to the firm. Any mail server can write any address into the From line. The only defence on the firm's side is a set of records: SPF and DKIM say what genuine mail looks like; DMARC says what to do with the rest.
Forged email is the one way in a firm can close with records of its own. At p=reject, receiving servers that follow DMARC refuse a message forged in the firm's exact name. A look-alike name is a different problem with its own steps.
Because the forged message carries the real address, it passes the test most people use, reading the sender. That is why a missing rule matters most at firms where money moves on an email: invoices, closings, draws and payroll.
Where does it show up in a reading?
In a LeakTrace reading it is read under “Forged email in your name”: the records that tell inboxes whether to refuse email sent as you (DMARC, SPF and DKIM).
The firm's other domains are read the same way, since a rule on one domain does not cover another.
Which pages use this term?
Where does this come from?
- RFC 7208, Sender Policy Framework (SPF)rfc-editor.orgRead 1 November 2026
See what is open before anyone else does.
We read your domain from outside and show each way in with a check anyone can re-run.