My website e-mail is getting 'spoofed' and I would like to put things in place to avoid that happening. As some background, I have a shared hosting account with a dozen domains added to my hosting account. I do not receive many e-mails but recently (twice in the past 2 months) have had an e-mail address locked by my host due to this spoofing activity. I use a PHP form for the Contact Us page and it uses mail() and has an autoresponder. I have read that there are ways to mitigate spoofing with using DMARC in a DNS setting. Do you have any tips for preventing spoofing or links to good articles? Thank you in advance.

2 Answers 2


There is no way to prevent someone to spoof your address. The sender information shown in e-mails (the From: field) can be spoofed easily. But usually, mail clients (like gmail) have logic to detect which email is spoofed or not.

Maybe your email account hosting been locked because you detected as a spoofer, to prevent this just use the email from field with your authenticated email address. Or you should not set the from field(just make it as default).

Another way just use different mail hosting than from your shared hosting. Shared hosting has very restricted and limited email. It's not recommended for sending emails except for testing or rarely usage.

  • So that's not 'spoofed' but it's 'hacked'. Just change the password, or the last option is using different mail hosting. May 18, 2020 at 2:29
  • Email spoofing is the creation of email messages with a forged sender address. The core email protocols do not have any mechanism for authentication, making it common for spam and phishing emails to use such spoofing to mislead or even prank the recipient about the origin of the message. May 18, 2020 at 2:43
  • Spoofer can not use your email hosting if they don't know your password/credential, but they can easily spoof your address with another hosting(and this will never affect your hosting). Maybe you are detected as the spoofer because you are sending a massive email that not allowed by your provider, or your website form is spammed by someone. May 18, 2020 at 2:48
  • 1
    My understanding is that if you use SPF/DMARC/DKIM DNS options available, then when someone spoofs your domain's email addresses, the receiver's email system if they have verification lookups enabled, will flag the email as potentially false/spam. If you have all that setup, and someone is complaining that they're received authenticated spoofed emails from your domain, then likely your email system is compromised and you need to work with your provider to tighten security, as the spoofed emails should never be verifiable if you have the DNS setup correctly is my understanding.
    – RCG
    May 18, 2020 at 20:25
  • The issue at my host is that these spoofed e-mails are failing to be delivered. Whoever is sending them has an automated system that keeps re-trying and my host receives notification of the failed delivery. This failure is triggering my host to send me notifications by e-mail. I notice this excessive amount of e-mails at what is otherwise a quiet e-mail address and have to contact my host to stop them.My host told me I was being spoofed. May 19, 2020 at 13:24

I am surprised by the accepted answer (which is largely incorrect. I'd downvote it, but I don't downvote where I answer as well). You can and should largely prevent spoofing by setting up SPF - ie DNS records what servers can send emails with your domain associated with the sender. This is fairly easy to do - just Google "Creating an SPF record".

Even better would be to enable DMARC and DKIM which are additional DNS based mechanism (DKIM requires server support) to sign your emails. This is a lot harder to do.

Its worth pointing out that not all servers check SPF, DKIM, DMARC, but the vast majority of credible ones - including Microsoft and GMAIL do.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.