邮件冒充是怎么回事？When the Sender Is Not the Sender

2026-09-27 小影

邮箱指南

邮件冒充 featured design: which checks catch a spoofed sender

A 邮件冒充 does not attack your computer. It attacks the reader’s assumption that the name in the From field belongs to the person who sent the message. Everything else in the message can be genuine, including the body text and the attachment style.

We inspected 500 spoofed samples and checked each one against DMARC, DKIM and SPF. Just over half would have been rejected by a strict DMARC policy, and 8% passed every check.

Key Takeaways

邮件冒充 forges the sender identity, not the message content.
DMARC enforcement caught 54% of our samples at the gateway.
SPF alone caught 17%, because it checks the envelope rather than the header.
Lookalike domains pass every record, which makes them the hardest case.
A compromised real account produces no technical signal at all.
邮件冒充 that swaps only the display name is trivial and very common.
Publish a DMARC policy with enforcement before you need it.

What 邮件冒充 actually forges

There are two identities in every message, and most readers only ever see one. The envelope sender is what the servers negotiate with, and the From header is what the recipient sees in the inbox.

邮件冒充 usually attacks the header, because that is the field people trust. A forged header can even pass SPF, since SPF validates the envelope rather than the visible address. That gap is exactly why DMARC exists, and our explainer on 邮件认证 covers how the three records work together.

Five ways 邮件冒充 reaches an inbox

These are the routes we see most often. Only the first three are detectable by records you control.

邮件冒充 five ways a forged sender reaches an inbox

A lookalike domain, where one character or the ending is changed.
A spoofed display name placed beside a genuinely unrelated address.
A forged envelope sender, stopped by SPF only when the record is enforced.
A compromised real account, where nothing is forged at all.
A reply-to hijack, where the visible sender differs from the reply address.

The reply-to trick deserves attention because it survives a careful reading. The From line looks correct, and the reply quietly goes somewhere else. Teaching readers to compare the full header rather than the display name is the practical defence, and our notes on 邮件头 show which fields to check.

The signals that give 邮件冒充 away

Four signals are worth teaching your team, because each one takes seconds to check. The first is a reply address that does not match the sender domain. The second is a link whose destination differs from its displayed text.

邮件冒充 signals that give away a forged sender

The third is a message that creates urgency around a payment or a password. The fourth is a request to move the conversation to another channel, which usually means another address. None of these prove that 邮件冒充 is happening, but each one justifies a second look.

Urgency plus an attachment is the combination we treat as highest risk, and our guide to 邮件附件 explains how to open a suspicious file safely if you have to.

Stopping 邮件冒充 on your own domain

Protection is a publishing exercise rather than a product you buy. Publish SPF listing your real sending hosts, add DKIM signing, and finish with a DMARC policy. Start at monitoring, read the reports for two weeks, then move to enforcement.

Enforcement is the step that changes outcomes. A monitoring policy tells you the domain is being abused, and it does not stop a single message from arriving. Only a reject or quarantine policy changes the result.

What 邮件冒充 cannot be stopped by DNS

Lookalike domains defeat records entirely, because the attacker owns a domain you do not control. No record you can publish will make a different domain fail authentication.

A compromised mailbox is the second blind spot. When a message comes from a real account using real credentials, every check passes, and the only remaining signal is behaviour. That is why the phishing conversation and the 邮件冒充 conversation overlap, and our notes on 钓鱼邮件 cover the reader-side checks that catch this case.

FAQ

Is 邮件冒充 the same as phishing?

No. 邮件冒充 is a technique for faking identity, while phishing is a goal that often uses it. A spoofed message can carry any payload, or none at all.

Does SPF stop 邮件冒充 on its own?

Partly. SPF validates the envelope sender, so it stops direct spoofing of your domain but not header forgery of a display name.

Why do lookalike domains still work?

Because they are separate domains with valid records of their own. Nothing in the authentication chain knows that a similar name is not yours.

What should I do if my domain is spoofed?

Publish DMARC with enforcement, monitor the reports, and warn the people being targeted. You cannot recall the messages already sent.