Spoofing means falsifying technical identity or origin information. An attacker makes traffic, messages or devices appear to come from a trusted source. The term describes a technique rather than one attack: impact and protection differ substantially depending on whether email, IP, DNS, ARP, a telephone number or a website is imitated.
Which types of spoofing exist?
| Type | Principle and limitation |
|---|---|
| Email spoofing | Sender fields are forged; SPF, DKIM and DMARC can assess certain forms of forgery. |
| IP spoofing | A packet's source IP is replaced. Replies normally go to the forged address, making it especially relevant to UDP reflection and trust based on addresses. |
| ARP spoofing | False ARP mappings on a local network redirect traffic through the attacker's device. |
| DNS spoofing | Manipulated name resolution returns a false destination and can enable pharming. |
| Caller ID and SMS spoofing | A familiar number or sender name appears without reliably authenticating the caller. |
| Website and domain spoofing | A lookalike domain, copied design or similar Unicode characters imitate a legitimate service. |
| GPS and radio spoofing | Counterfeit signals influence location, time or wireless identities. |
What can an attacker achieve?
Spoofing creates trust or redirects communication. It supports phishing and fraud, bypasses simple IP allowlists, enables reflection DDoS or prepares a man-in-the-middle attack. A forged attribute does not automatically mean replies can be read. With IP spoofing and no position on the return path, the attacker generally cannot see the response.
How do spoofing, phishing and MitM differ?
Spoofing is technical falsification of an attribute. Phishing deceives a person, often using a spoofed sender or lookalike domain. In a man-in-the-middle attack, the adversary is actively in the communication path and can observe or alter data. Spoofing may prepare MitM but need not lead to it.
How is spoofing prevented?
- Verify identity cryptographically: validate TLS certificates and use signed protocols and strong mutual authentication.
- Protect email domains with SPF, DKIM and monitored DMARC; monitor lookalike domains separately.
- Providers and network operators should filter packets with implausible source addresses at network boundaries.
- Harden local networks with segmentation, DHCP snooping, Dynamic ARP Inspection and secure switch ports where supported.
- Validate DNSSEC and protect resolvers and endpoints against manipulation; DNSSEC does not encrypt DNS.
- Confirm payments, account recovery and sensitive changes through independent known channels.
How is it detected and investigated?
Indicators include changing MAC-to-IP mappings, unexpected DNS answers, certificate warnings, implausible packet sources, DMARC failures or calls from familiar numbers with unusual requests. Analysis correlates email headers, DNS and DHCP logs, switch tables, packet captures, certificates and the actual domain. A display name, phone number or source IP alone is not reliable proof of identity.
Thank you for your feedback! We will review it and optimize this content.