Email spoofing forges the "From" address so a message appears to come from a trusted domain (your company, a bank, etc.) when it didn’t — a foundational technique behind most phishing.
Why it’s technically easy without protection
The base email protocol (SMTP) doesn’t verify the "From" address by default — anyone can technically claim any sender address unless the receiving server actively checks SPF/DKIM/DMARC.
How DMARC (with SPF and DKIM) stops it
With DMARC enforcement in place, a receiving server that gets a message failing both SPF and DKIM alignment can quarantine or reject it per your published policy — meaning attackers can no longer successfully spoof your exact domain to recipients whose mail providers respect DMARC.
FAQ
Does DMARC stop all phishing that mentions my brand?
No — it stops spoofing of your exact domain; attackers can still use look-alike domains (typosquatting) that DMARC doesn’t cover, which requires separate monitoring.