Spoofing is a cyberattack in which the attacker disguises their identity or the source of a message — pretending to be a trusted computer, server, or person. Spoofing attacks underpin many broader threats including phishing, session hijacking, and distributed denial-of-service attacks.
What does "spoofing" mean?
Spoofing takes its name from a card game — a bluffing game about deception. In computing, spoofing means faking an identity at the network or application level. The victim believes they are communicating with a trusted source; in reality, they are interacting with the attacker.
Spoofing is not the same as hacking into a system to steal credentials. Instead, it abuses the trust that networks and users place in identifiers — IP addresses, email addresses, domain names — by forging those identifiers.
The attacker asks: "what does this system trust, and can I impersonate it?"
What is IP spoofing?
Every packet sent over the internet contains a source IP address. IP spoofing involves placing a false IP address in the source field of a packet, making it appear to come from a different machine.
Why is this possible? The IP protocol was designed for reliability, not authentication. It trusts the source address field in the packet header without verifying it.
Uses of IP spoofing:
- DDoS amplification attacks — an attacker sends a small request with the victim's IP as the spoofed source. A server replies with a large response directed at the victim, amplifying the traffic the victim receives without the attacker being identified.
- Bypassing IP-based access controls — systems that allow access based on source IP can be fooled if the attacker can spoof a trusted IP.
- Concealing the attacker's location — spoofing makes it harder to trace the source of an attack.
Defence: modern routers can use ingress filtering — discarding packets whose source IP address does not match the expected range for that network interface, making spoofed packets harder to propagate.
What is email spoofing?
Email spoofing involves forging the From: address in an email to make it appear to come from a trusted sender — a colleague, bank, or government agency.
Email was designed in the 1970s with no authentication mechanism. The From: header is just plain text that any mail client can set to any value. Without additional defences, nothing stops an attacker from setting From: ceo@yourcompany.com when sending from their own server.
Email spoofing is the foundation of phishing: the attacker sends an email appearing to be from a trusted organisation, with a link to a fake login page.
Defences:
| Technology | What it does |
|---|---|
| SPF (Sender Policy Framework) | A DNS record that lists which IP addresses are allowed to send email for a domain. If a spoofed email comes from an unlisted IP, receiving servers can reject it |
| DKIM (DomainKeys Identified Mail) | Adds a digital signature to each email. The receiving server checks the signature against the sender's public key in DNS |
| DMARC | Builds on SPF and DKIM, specifying what to do when checks fail (reject, quarantine, or report) |
When all three are in place, spoofing a legitimate domain's email is extremely difficult. Many phishing emails therefore use look-alike domains (paypa1.com instead of paypal.com) rather than true spoofing of the real domain.
What is DNS spoofing?
The Domain Name System (DNS) translates human-readable domain names (bbc.co.uk) into IP addresses. DNS spoofing (also called DNS cache poisoning) corrupts a DNS resolver's cache with false records, redirecting users to attacker-controlled servers.
How it works:
- Attacker sends fraudulent DNS responses to a resolver, claiming that
mybank.comresolves to the attacker's IP address. - The resolver caches the false entry.
- Any user who queries that resolver for
mybank.comis directed to the attacker's fake site — even though they typed the correct address.
Defence: DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records. Resolvers verify the signature before accepting a response, making it computationally infeasible to inject false records. DNSSEC adoption has grown but is not yet universal.
How does spoofing compare with other cyberattacks?
| Attack | Primary goal | Core technique |
|---|---|---|
| Spoofing | Impersonate a trusted identity | Forge identifiers (IP, email, DNS) |
| Phishing | Trick users into revealing credentials | Social engineering (often using spoofing) |
| Man-in-the-middle | Intercept and read/alter communications | Position between two parties |
| Denial of service | Overwhelm a system | Flood with traffic (often using IP spoofing) |
Spoofing is frequently an enabler for other attacks rather than an end in itself. IP spoofing amplifies DDoS attacks; email spoofing enables phishing; DNS spoofing enables redirection attacks.
How can individuals protect themselves from spoofing?
| Action | Protection offered |
|---|---|
| Verify sender email addresses carefully | Catch look-alike domains (paypa1.com) |
| Hover over links before clicking | See the real destination URL |
| Use HTTPS sites only for sensitive actions | Protects against DNS spoofing redirecting you to HTTP fakes |
| Enable two-factor authentication | Even if credentials are stolen via a spoofed site, 2FA provides a second barrier |
| Keep DNS resolver software updated | Patched resolvers are resistant to known DNS poisoning techniques |
Frequently asked questions
How is spoofing different from phishing?
Phishing is a social engineering attack that tricks users into voluntarily providing information. Spoofing is a technical forgery of an identity or address. The two frequently work together: email spoofing makes phishing emails appear trustworthy, while DNS spoofing directs users to fake sites. Phishing targets human psychology; spoofing targets technical trust mechanisms. Both can occur independently — not all spoofing involves phishing, and not all phishing uses spoofing.
Can caller ID be spoofed on phone calls?
Yes. Telephone caller ID uses the SS7 protocol, which — like early internet protocols — was designed without authentication. Attackers can place calls that display any number in the recipient's caller ID display, including the number of a bank, NHS helpline, or government agency. This technique is used in vishing (voice phishing) attacks. Telecoms regulators in the UK (Ofcom) and other countries have introduced measures to reduce spoofed calls, but the problem has not been fully eliminated.
What is ARP spoofing?
ARP (Address Resolution Protocol) maps IP addresses to MAC addresses on a local network. ARP spoofing sends fake ARP replies to other devices on the same network, associating the attacker's MAC address with a legitimate IP address (such as the default gateway). All traffic intended for that IP then flows to the attacker's machine — a form of man-in-the-middle attack. ARP spoofing only works on the local network (same LAN segment) and is one reason why using untrusted Wi-Fi is risky.
Is spoofing illegal in the UK?
Deliberately spoofing identities to commit fraud, gain unauthorised access, or disrupt systems is illegal under the Computer Misuse Act 1990 and the Fraud Act 2006. Email spoofing used to impersonate a business for financial gain is fraud. IP spoofing used in a DDoS attack is an unauthorised modification of a computer system. Penalties include fines and imprisonment. Academic study of spoofing techniques in a controlled environment (such as in a lab or ethical hacking course with authorisation) is legal.
Need to understand cybersecurity for your GCSE? Professor Turing at aitutors.me explains every attack and defence with clear, memorable analogies.