Email remains the single biggest way attackers get into small businesses—not just through phishing links, but through spoofed sender addresses and fully compromised, legitimate accounts. This guide shows you how to verify what you're looking at before you trust it.
Email Spoofing Basics
Spoofing means forging the "From" field so an email appears to come from someone it didn't. Because the core email protocol (SMTP) wasn't built with authentication in mind, anyone can put any name and address in the "From" line. Modern email systems use three technical checks— SPF, DKIM, and DMARC—to help catch this, but they aren't foolproof and not every organization enforces them strictly.
SPF, DKIM, and DMARC
- SPF (Sender Policy Framework): Confirms the sending mail server is authorized to send email for that domain
- DKIM (DomainKeys Identified Mail): A digital signature proving the message wasn't altered in transit
- DMARC (Domain-based Message Authentication):Tells receiving servers what to do if SPF/DKIM checks fail (quarantine, reject, or allow)
- A message can still reach your inbox even if it fails these checks—many organizations don't enforce strict DMARC policies
Domain Verification: Look Closely
Attackers rely on you skimming instead of reading carefully. Slow down and check the actual domain, not just the display name.
Tricks Attackers Use
- Lookalike characters:
rnicrosoft.com(rn instead of m),amaz0n.com(zero instead of "o") - Extra subdomains:
paypal.com.secure-verify.net— the real domain is "secure-verify.net," not PayPal - Different top-level domain:
yourbank.coinstead ofyourbank.com - Display name spoofing: The name shown is "Jane Smith, CEO" but the actual address is a random Gmail account
- Reply-to mismatch: The "From" address looks right but the "Reply-To" field routes responses elsewhere—check both
Header Analysis Walkthrough
How to Check Full Email Headers
Every email carries hidden routing information in its headers. Most email clients let you view this via "Show Original," "View Source," or "Message Details."
Received: from mail-relay.suspicious-host.net (unverified [203.0.113.44])
by yourcompany-mail.com; Mon, 20 Jul 2026 09:14:02 -0400
From: "Accounts Payable" <billing@yourcompany.com>
Reply-To: ap-billing@fastpay-invoices.net
Authentication-Results: spf=fail smtp.mailfrom=fastpay-invoices.net;
dkim=fail; dmarc=fail- Check "Authentication-Results": Look for
spf=fail,dkim=fail, ordmarc=fail—any failure is a red flag - Trace "Received" lines from bottom to top: These show the actual path the email traveled. A mismatch between the claimed sender and the originating server is suspicious
- Compare "From" and "Reply-To": If they point to different domains, treat the message as suspicious
- Check the originating IP: Look it up—an email claiming to be from your own company shouldn't originate from an unfamiliar hosting provider overseas
Real Email Examples: Legitimate vs. Suspicious
Legitimate
Suspicious
Red Flags Checklist
Before You Trust an Email, Check For
Signs Your Own Account Has Been Compromised
- Sent items you don't recognize, or contacts report odd emails from you
- New forwarding rules or filters you didn't create
- Login alerts from unfamiliar locations or devices
- Missing emails, or emails marked read that you never opened
- Password reset emails for accounts you didn't request
- Changes to your signature, display name, or recovery email/phone
- Change your password immediately from a clean, trusted device
- Enable or re-verify multi-factor authentication
- Check and remove any unfamiliar forwarding rules or filters
- Review "Sent" and "Deleted" folders for signs of misuse
- Review connected apps and revoke access for anything unrecognized
- Notify your IT/security team so they can check for lateral movement
Common Phishing Variants to Recognize
Business Email Compromise (BEC): Impersonates an executive or vendor to request a wire transfer or payment change. Often uses a lookalike domain, not a hacked account.
Invoice/Payment Fraud: Attacker inserts themselves into a legitimate email thread (sometimes after compromising a vendor's account) and asks you to redirect payment to new banking details.
Account Compromise Follow-Through: Once an account is hacked, attackers send phishing to your entire contact list using your real, trusted address—no spoofing required, which makes it especially convincing.
Thread Hijacking: Attacker replies within an existing email conversation with a malicious link, exploiting the trust already built in that thread.
Safe Practices
- Verify payment or banking detail changes by phone, using a number you already have on file—not one in the email
- Enable MFA on all email accounts, especially admin accounts
- Turn on SPF, DKIM, and DMARC enforcement for your own domain
- Check full headers when something feels off, even slightly
- Report suspicious emails to IT instead of just deleting them
- Keep your email client and browser updated
- Don't trust the display name alone—always check the full address
- Don't click "verify your account" links from unexpected emails
- Don't change payment details based on an email request alone
- Don't reuse your email password on other sites
- Don't assume a reply within an existing thread is automatically safe