We have fully configured SPF, DKIM and DMARC policies (100% reject) for our email domain (e.g. spoofed.com), which is managed by gmail, but we have recently started seeing spear phishing emails with the following format (our email addresses/names have been sanitised):

From: Bob Smith [email protected] <[email protected]>
Date: Wed, Aug 26, 2020 at 10:02 AM
Subject: External legal counsel.
To: <[email protected]>


I am contacting you regarding a sensitive operation that I have approved and for which I need you to manage it, has Adv.Thomas Legler informed you about this case?

Best Regards,
Bob Smith

Sent from my iPhone

The email From: header is:

From: "Bob Smith [email protected]" <[email protected]>

So we can see that the [email protected] "faked" email address that the phisher is trying to imitate is part of the email alias/phrase field. Such From headers might incorrectly lead recipients to believe the email has genuinely come from [email protected] when in fact it's from [email protected].

Are there any further best practice protections we can put in place to avoid spoofed email addresses being included in the email alias in this way?

If any further headers are required please let me know.

1 Answer 1


DMARC (and SPF and DKIM, though those aren't strong enough to block with without DMARC) key solely on the domain in the address, not the free-form field known as Friendly From or Display Name (or Alias or Phrase). There is no such equivalent for Friendly From spoofing. (BIMI is an attempt at corporate logos, but that's again not Friendly From.)

For mailboxes you control, you can write a filter that kills these. I don't know GMail's options (start by enabling Gmail's advanced anti-phishing and malware settings), but using the F/OSS SpamAssassin software, you can write a rule like this:

header    MF_SPOOFED_SPOOFED_COM  From:name =~ /\@spoofed\.com\b/i
describe  MF_SPOOFED_SPOOFED_COM  https://security.stackexchange.com/a/237604/42391

I'm using the prefix MF_ because your Stack Exchange handle implies those are your initials. It's always good to take credit so you and your peers can troubleshoot what's going on when there's an issue.

For mailboxes you do not control, there's unfortunately nothing you can do to stop forgeries of your domain that do not use your exact domain in the From header address.

  • 1
    Many thanks for the feedback. Whilst looking how to achieve this I also came across G Suites advanced anti-phishing settings which hopefully address this issue. For some strange reason they are disabled by default - techrepublic.com/article/…
    – MarcF
    Aug 27, 2020 at 17:07
  • Nice, I've added that to my answer. There must be a false-positive or user-training concern if it's disabled by default (for example, it can file unauthenticated (non-SPF/DKIM) mail as spam, which I highly recommend against).
    – Adam Katz
    Aug 27, 2020 at 17:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .