Email spoofing is the practice of making a message look as if it came from a trusted sender when it actually did not. Attackers may forge the visible From address, manipulate reply paths, or send mail through infrastructure that hides the real origin.
It matters because many people and systems still treat the sender line as a sign of legitimacy. Spoofed mail is often used in phishing, impersonation, and social engineering to pressure recipients into opening documents, sharing information, or following instructions. In real defenses, organizations reduce this risk with SPF, DKIM, and DMARC, which help verify whether a domain is allowed to send mail and how forged messages should be handled. Users should also confirm unusual requests through known-good contact channels instead of replying directly to the suspicious email.