Someone spoofed my address. Was my account hacked?

Not necessarily. Spoofing needs no access to your account. If the messages do not appear in your Sent folder, someone likely forged your address. If they do appear there, change your password and check your sign-in activity.

Can spoofed email pass SPF and DKIM?

Yes, for the spammer's own domain. That is why DMARC alignment matters: it checks that the domain that passed is the same one shown in From.

Learn

What is email spoofing? How fake senders work

Sending email that pretends to come from someone else, and the checks that make it harder.

Why spoofing is possible

Email was designed in a time when the people on the network trusted each other. SMTP lets the sending server state any sender address it likes, both in the envelope (MAIL FROM) and in the From header that you see. Nothing in the original protocol checks either one.

So forging a sender is easy. Anyone who can run a mail server, or use a sending service, can write From: ceo@yourcompany.com at the top of a message. Spoofing is the core of most phishing, invoice fraud and CEO fraud scams.

Three common forms

Exact-domain spoofing uses the real address, such as security@paypal.com, in the From line. This is the kind that SPF, DKIM and DMARC are built to stop, and on domains with a strict DMARC policy it rarely reaches your inbox.

Lookalike domains use an address that is close to the real one: paypa1.com, micros0ft-support.com, or rn in place of m. The scammer owns that domain, so it can pass every authentication check. Only a careful look at the address catches it.

Display-name spoofing is the simplest. The address is something random, but the name in front of it is the one you trust, and many mail apps show only the name:

From: "PayPal Support" <alerts-7731@quick-mailer.example>
From: "Jane Smith (CEO)" <jane.smith.office@freemail.example>

How SPF, DKIM and DMARC work together

SPF lets a domain list which servers may send its mail, and checks the envelope sender. DKIM signs each message with the domain's key. On their own, both can pass for a scammer's domain while the visible From shows yours.

DMARC ties them together. It requires SPF or DKIM to pass for the same domain that appears in From, and it tells receivers what to do when that fails. With p=reject, a message showing From: someone@example.com that is not properly signed or sent from an approved server is turned away. The result is recorded in the Authentication-Results header:

Authentication-Results: mx.example.net;
       spf=fail smtp.mailfrom=quick-mailer.example;
       dkim=none;
       dmarc=fail (p=REJECT) header.from=example.com

What you can do

If you own a domain, publish SPF and DKIM for every service that sends your mail, start DMARC at p=none, read the reports, and move to p=quarantine or p=reject. A domain with no DMARC policy is the easiest one to spoof.

As a reader, look at the full address, not just the name. Be wary of messages that push you to pay, sign in or change bank details, even when the sender looks familiar, and confirm through a channel you already trust.

Questions

Someone spoofed my address. Was my account hacked?: Not necessarily. Spoofing needs no access to your account. If the messages do not appear in your Sent folder, someone likely forged your address. If they do appear there, change your password and check your sign-in activity.
Can spoofed email pass SPF and DKIM?: Yes, for the spammer's own domain. That is why DMARC alignment matters: it checks that the domain that passed is the same one shown in From.