What can I do if my email address is being used for phishing emails?
Matthew Whittaker
Co-founder & CTO, Suped
Published 13 Jun 2025
Updated 19 Aug 2025
7 min read
It can be quite alarming to discover that your email address is being used in phishing scams. You might receive bounce-back messages, or even get replies from confused recipients, which is how I first found out this was happening with one of my own email addresses.
This situation often involves email spoofing, where malicious actors forge the 'From' address to make it appear as though the email originates from you or your domain. They do this to trick recipients into believing the email is legitimate, increasing the chances of their phishing attempt succeeding. It's a common tactic in cybercrime, and unfortunately, it can impact your brand's reputation.
While it can feel overwhelming, there are clear steps you can take to address this issue. These actions range from immediate responses to long-term preventative measures, ensuring both your personal security and your domain's integrity.
Identifying the issue
The first step is to confirm that your email address is indeed being used for phishing. Sometimes, an email address might appear in spam lists randomly, leading to a few isolated instances of spoofing. Other times, it could be a more targeted attack where your brand is being specifically impersonated.
One key indicator is if you receive bounce-back messages for emails you never sent. Another common sign is when a recipient replies to a phishing email, thinking it came from you. In my own experience, the 'From' name was different from the 'Reply-To' address, indicating a clear spoofing attempt. If you can get your hands on the full email headers of a suspicious message, it can often reveal the actual sending infrastructure, which might point to a legitimate provider being abused.
It's important to distinguish between random spoofing and a targeted brand attack. Random spoofing might subside on its own, but targeted attacks require a more proactive response.
How to verify spoofing
When you suspect your email address is being spoofed, examining the full email headers is crucial. These headers contain a wealth of information about the email's journey and origin, which can help confirm if your domain is merely being forged or if there's a deeper compromise.
Look for discrepancies in the 'From' address versus the 'Return-Path' or 'Received' headers. If your domain is in the 'From' field but the technical sending domains differ, it's a strong indication of spoofing. This information is key to understanding the scope of the problem.
Example of email headers showing spoofingtext
Received: from mail.attacker.com (mail.attacker.com [192.0.2.1])
by yourdomain.com (Postfix) with ESMTP id ABCDEF12345
for <recipient@example.com>; Mon, 1 Jan 2024 12:00:00 -0000
From: "Your Brand" <your_email@yourdomain.com>
Subject: Important Security Alert
To: recipient@example.com
Return-Path: <spoofed_sender@otherdomain.com>
Authentication-Results: mx.google.com;
dkim=fail header.i=@yourdomain.com header.s=default;
spf=temperror (google.com: error in processing SPF record) smtp.mailfrom=spoofed_sender@otherdomain.com;
dmarc=fail (p=none dis=none) header.from=yourdomain.com
This is a phishing email.
Short-term reactions and reporting
Once you've identified that your email address is being used in phishing attempts, immediate action is necessary. For isolated incidents, simply waiting might be enough, but for persistent or widespread abuse, a more direct approach is needed.
If the phishing involves your brand or service, it's a good idea to proactively warn your customers. This can be done through a notice on your website, a social media post, or even a legitimate email campaign. This helps prevent your users from falling victim to the scam and protects your brand reputation. For more details on protecting your brand, you can learn about brand and sender profile impersonation.
Reporting the phishing emails is also crucial. You can forward suspicious emails to organizations like the Anti-Phishing Working Group (APWG) at reportphishing@apwg.org. Additionally, you can report the incident to the FBI's Internet Crime Complaint Center (IC3). If you're using a specific email provider, like Gmail or Outlook, they often have specific channels for reporting phishing attempts that impersonate their services or use their platforms for abuse.
What not to do
If you receive a suspicious email, even if it appears to be from your own address, do not click on any links, open attachments, or reply to the message. Engaging with the phishing email can inadvertently provide attackers with more information or compromise your device.
Also, avoid simply blocking the sender's email address if it's a spoofed message. The 'From' address is likely forged, and blocking it might inadvertently filter out legitimate emails in the future if a different scammer uses your address again.
Random spoofing
This occurs when your email address is pulled from a spam list at random and used as the 'From' address in phishing or spam campaigns. The attackers are not necessarily targeting your brand specifically, but rather using your address as a disposable cover. It often involves different 'Reply-To' addresses or links that lead elsewhere.
Impact: Minor impact on your sender reputation, mostly bounce-backs or confused replies.
Solution: Often resolves itself, but DMARC provides long-term protection.
Targeted brand impersonation
In this scenario, attackers specifically choose your brand or domain to impersonate. Their goal is to leverage your established trust to deceive your customers, employees, or partners. This type of attack is more dangerous as it directly threatens your brand's credibility and user security.
Impact: Significant risk to brand reputation, customer trust, and potential financial losses for victims.
Solution: Requires proactive measures like customer warnings and robust email authentication.
Long-term prevention with email authentication
For long-term protection against email spoofing and phishing that uses your domain, implementing strong email authentication protocols is essential. These protocols help recipient servers verify that emails truly originate from your domain and prevent unauthorized use of your email address.
The most effective solution is DMARC (Domain-based Message Authentication, Reporting, and Conformance). DMARC builds upon SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to give you control over what happens to emails that fail authentication. Initially, you can set your DMARC policy to 'p=none', which provides valuable insights into who is sending emails on behalf of your domain, including malicious actors.
Once you have a clear picture, you can gradually move to stricter DMARC policies like 'p=quarantine' or 'p=reject'. This tells receiving mail servers to either put unauthenticated emails into spam folders or block them entirely, effectively stopping phishing attempts that use your domain. Learning about DMARC, SPF, and DKIM is a critical step in email security.
These protocols work together to verify the sender's identity and ensure email integrity. SPF specifies which servers are authorized to send email on behalf of your domain, while DKIM adds a digital signature to outgoing emails, allowing recipients to verify that the email was not tampered with. DMARC then uses the results of SPF and DKIM checks to determine how receiving servers should handle emails from your domain, especially those that fail authentication.
Implementing DMARC effectively
Starting with a DMARC policy of p=none is recommended. This allows you to gather DMARC reports without affecting your legitimate email flow. These reports provide invaluable data on who is sending emails using your domain, helping you identify unauthorized senders and potential phishing campaigns.
Once you're confident that all your legitimate sending sources are properly authenticated, you can advance your policy to p=quarantine or p=reject, effectively blocking malicious emails. You can find out more about safely transitioning your DMARC policy.
Protocol
Purpose
Benefit for phishing prevention
SPF (Sender Policy Framework)
Authorizes specific IP addresses to send mail on behalf of your domain.
Prevents spammers from sending emails using your domain's address from unauthorized servers.
DKIM (DomainKeys Identified Mail)
Adds a digital signature to emails, verifying the sender and message integrity.
Ensures that the email has not been altered in transit and truly came from the claimed sender.
DMARC (Domain-based Message Authentication, Reporting, and Conformance)
Sets a policy for how recipient servers should handle emails that fail SPF or DKIM alignment, and provides reports.
Directly combats email spoofing by allowing domains to instruct receiving mail servers to reject or quarantine unauthenticated emails.
Monitoring and ongoing vigilance
Implementing DMARC is a significant step, but ongoing vigilance is key to maintaining email security. This includes regularly monitoring your DMARC reports, keeping an eye on your domain's sender reputation, and understanding how blocklists (also known as blacklists) can impact your deliverability.
DMARC reports provide continuous feedback on email authentication failures, helping you spot new or persistent spoofing attempts. Understanding and troubleshooting DMARC reports from Google and Yahoo is essential for this. Your domain's reputation, influenced by factors like spam complaints and blocklist listings, directly affects whether your legitimate emails land in the inbox or spam folder.
Regularly checking if your domain or IP address has been placed on an email blocklist (or blacklist) is also critical. Being listed on a blocklist can severely impact your email deliverability. For a comprehensive overview, refer to an in-depth guide to email blocklists. Maintaining a good sender reputation and promptly addressing any issues with blocklists are ongoing tasks that reinforce your email security posture.
Views from the trenches
Best practices
Implement DMARC with a p=none policy to gain visibility into spoofing attempts.
Gradually transition DMARC to quarantine or reject policies for stronger enforcement.
Regularly monitor DMARC reports to detect and analyze unauthorized email sending.
Common pitfalls
Ignoring DMARC reports, missing critical insights into spoofing campaigns.
Jumping directly to a reject policy without proper monitoring, blocking legitimate emails.
Not educating customers about phishing risks and how to identify fraudulent emails.
Expert tips
Analyze full email headers for forensic details on spoofed messages.
Report phishing incidents to relevant authorities and email providers.
Inform users about potential phishing emails impersonating your brand.
Expert view
Expert from Email Geeks says that in email delivery terms, you should not worry about it too much in the short term, as there is not much you can do anyway. Longer term, DMARC is designed to discourage this kind of activity.
2023-06-19 - Email Geeks
Expert view
Expert from Email Geeks says that if someone is phishing your service, warning customers about ongoing phishing attempts through a regular email or a website notice might be a good idea.
2023-06-19 - Email Geeks
Protecting your email presence
Discovering that your email address is being used for phishing emails can be unsettling, but it's a manageable problem with the right approach. By understanding the nature of the spoofing, taking immediate reporting actions, and implementing robust email authentication protocols, you can significantly mitigate the risk.
Remember, email security is an ongoing process. Consistent monitoring of your email channels and DMARC reports, coupled with proactive communication to your audience, forms a strong defense against these persistent threats. By staying informed and taking decisive action, you can protect your domain and maintain trust with your recipients.
Gmail or 
Outlook, they often have specific channels for reporting phishing attempts that impersonate their services or use their platforms for abuse.
