How to block spoofed emails

When the answer changes

Choose the next action based on the evidence you have.

• If an employee received a suspicious message, preserve the message and use the reporting, investigation, and response process approved for that mailbox environment. The available evidence does not establish a universal rule for blocking, reporting, deleting, or marking that message as spam.
• If the concern is a lookalike domain, treat it as an impersonation signal. It is not, by itself, proof of the message's authentication state or the sender's intent.
• If the concern is that messages appear to come from your organization's domain, focus on domain authorization and the sending systems your organization approves. The available evidence supports that goal, but not a particular configuration procedure or enforcement result.
• If the concern is broad inbox protection, assess inbound email-security controls as part of a wider email security program.

Do not make a DNS or authentication-policy change based only on one suspicious message. First establish which domain, mailbox environment, and approved sending path are actually involved.

A worked decision rule

Use this decision rule to keep an investigation within the evidence available. It is a triage aid, not a guarantee that a message will be blocked or that a sender is legitimate.

Illustrative decision rule
If the evidence is a suspicious message in one mailbox:
  Use the mailbox provider's approved reporting and investigation process.
If the evidence is a lookalike sender domain:
  Treat it as an impersonation signal.
  Assess the message and the recipient risk separately.
If the evidence is concern about use of your organization's domain:
  Identify the approved sending systems.
  Review domain-authorization controls with the responsible email team.
If the evidence is a broad security concern:
  Review inbound email-security controls and domain protection as separate workstreams.

The rule avoids an unsupported shortcut: a suspicious message does not prove that a domain-wide authorization control failed, and a vendor's security alert does not prove a specific authentication result.

The same separation applies to business email compromise and VIP impersonation. IRONSCALES lists Business Email Compromise and VIP impersonation among its email-security use cases. Those categories help describe the risk under review. They do not reveal why a particular message arrived, whether a recipient will receive another message, or which control will resolve the case.

What to check next

Start with the evidence closest to the problem.

For a suspicious message, use the recipient's approved security process and collect only the information that process permits. The available material does not verify a universal mailbox-provider workflow, so follow the documentation and escalation path for the service your organization uses.

To decide whether a single message is forged before escalating it, see how to spot an email sender spoof, which covers the visible signals and the header lines that settle it.

For an organization-wide concern, write down the exact question before selecting a control:

• Is the concern inbound phishing or impersonation attempts against employees?
• Is the concern a lookalike sender domain?
• Is the concern unauthorized use of the organization's own domain?
• Is the concern an approved sender that needs review by the email team?

A public check or score cannot prove the production sending path, a mailbox provider's private filtering decision, continuous security state, or future inbox placement. It also cannot repair a suspicious message or establish that every sender using a domain is approved.

Review the email-security controls around the incident

When the concern extends beyond one message, review the organization-wide controls that cover inbound impersonation risk and domain authorization.

Explore email security

This guidance cannot determine why a particular mailbox received a message, block a future message, or confirm that all approved senders use the organization's domain correctly.