The most dangerous email impersonation attacks don’t look suspicious at all. They look exactly like email from your own company, because that’s who they claim to be.
We saw this recently. A professional services firm was targeted by a coordinated email impersonation campaign. Attackers sent messages that appeared to come from the firm’s own domain, including messages addressed back to the firm’s own employees. The sender address was correct. The wording was professional. Nothing on screen gave it away.
No accounts were compromised and no employee had to make a judgment call, because the firm’s email authentication controls flagged the messages as unauthorized and rejected them before they reached a single inbox.
If your defense against email impersonation depends on an employee noticing something is off, you’re relying on a signal that has mostly disappeared.
What Email Impersonation Is, and Why Your Domain Is the Target
Email impersonation is when an attacker sends a message that pretends to come from a person or organization the recipient trusts. The most effective version, often called domain spoofing, uses your actual email domain in the sender address.
Attackers want your domain because it carries credibility they can’t build on their own. Once a message looks like it came from you, it can be used to:
- Steal credentials. A believable “please log in to review this document” link from a colleague gets clicked far more often than one from a stranger.
- Redirect money. A wire or payment request that appears to come from finance or leadership skips the skepticism a random sender would trigger.
- Collect sensitive information. Client records, tax documents, and payroll data are easier to request when the request looks internal.
- Damage trust outside your walls. Even if no one falls for it, clients and partners who receive spoofed messages start doubting every email that carries your name.
“The biggest risk is that an attacker gains credibility simply because the email looks legitimate,” said Carlos Quiroz, IT Director at Duffy Kruspodin.
In other words, attackers don’t need to break into anything. They just borrow your name.
The Red Flags You Were Trained to Spot in Traditional Phishing Emails Are Disappearing
Most security awareness training still teaches people to look for misspellings, awkward grammar, generic greetings like “Dear Customer,” and urgency that feels a little too dramatic. Those signals used to catch a lot of phishing. They catch far less now.
AI is a big part of why. Attackers can generate polished, natural-sounding messages in seconds, then personalize them with details pulled from your website, LinkedIn, and business directories. The result references real employees, mirrors real business processes, and uses accurate branding.
But AI isn’t the whole story.
“Criminals have become better at impersonating brands and organizations, making emails look authentic from both a language and a design perspective,” Quiroz said.
Better writing is only half of it. The other half is that the sender address itself can look right.
Ask what an employee would actually see if a spoofed message got through, and the answer is uncomfortable. “In many cases, they would have seen what appeared to be a normal email from the company,” Quiroz said. “Unless the employee examined message headers, there may have been little indication that the email was fraudulent.”
Awareness training still matters, but it can’t be the control that decides whether a fake email succeeds. A professional-looking email is no longer evidence that it’s safe. Verification has to happen before the message reaches a person.
What Can Catch the Fake
In the campaign we saw, the messages used the company’s real domain. What exposed them was the authentication data behind each message.
“What gave it away wasn’t poor grammar, formatting, or an obvious phishing clue,” Quiroz said. “DMARC monitoring identified multiple messages claiming to be from the firm’s domain that originated from unauthorized systems. They failed SPF and DKIM validation and were automatically rejected before they could be delivered.”
Three email deliverability technologies work together:
- SPF (Sender Policy Framework) identifies which mail servers are authorized to send email on behalf of a domain. Receiving servers use SPF to check whether the sending server is authorized for the domain used in the email’s return path.
- DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing messages. Receiving servers can use that signature to verify the signing domain and confirm that signed portions of the message were not altered in transit.
- DMARC (Domain-based Message Authentication, Reporting, and Conformance) checks whether SPF or DKIM successfully authenticates in alignment with the domain shown in the From address. It also publishes a policy telling receiving servers how to handle messages that fail DMARC and provides reporting that helps domain owners identify systems sending email on behalf of their domain.
SPF and DKIM provide authentication signals, while DMARC ties those signals to the domain visible in the From address and publishes a policy for handling messages that fail authentication. An enforcement policy such as quarantine or reject provides stronger protection against direct domain spoofing than a monitoring-only policy.
The Email Security Gap Most Companies Don’t Know They Have
Most organizations aren’t completely unprotected. They’re partly protected, which is harder to notice.
“The most common issue is incomplete email authentication,” Quiroz said. “Many organizations have SPF or DKIM partially configured but have not fully implemented or enforced DMARC.”
That gap matters because a DMARC record that only monitors is like a security camera nobody watches. Spoofed messages still go through, and the reports that would reveal them pile up unread. Quiroz said his team also regularly finds companies that aren’t reviewing authentication reports at all, so they have no idea who is sending email in their name.
If you’ve never confirmed that DMARC is set to enforce, and that someone is reading the reports, assume you have this gap.
Stop Email Impersonation At The Source
Based on the security evidence reviewed, the spoofed messages were identified and rejected by the firm’s email authentication controls. That outcome came from controls that were configured, enforced, and monitored before the attack started, not from someone spotting the fake.
That’s the standard worth holding your own domain to. Your team should still question unusual requests and verify payment changes by phone. But the decision about whether a message claiming to be from you is real should be made by your mail infrastructure, not by a busy employee scanning an inbox.
If you’re not sure where your domain stands, start with an email domain review. Our IT team will check your SPF, DKIM, and DMARC configuration, confirm whether enforcement is actually on, and show you who is sending email using your name.
Frequently Asked Questions About Email Impersonation
What is email impersonation?
Email impersonation is a phishing tactic where an attacker sends a message pretending to come from a trusted person or organization. The most convincing form uses the real company domain in the sender address, which is known as domain spoofing.
How can you tell if an email is impersonating your company?
Often you can’t by looking at it. Modern impersonation emails use correct branding, professional language, and real names. The reliable signal is technical: whether the message passes SPF, DKIM, and DMARC checks for your domain.
Does DMARC stop email impersonation?
DMARC helps prevent unauthorized use of your exact domain in the visible From address when an enforcement policy such as quarantine or reject is configured and SPF or DKIM is properly implemented and aligned. A monitoring-only DMARC policy provides visibility through reporting but does not request that receiving systems quarantine or reject messages that fail DMARC.
