Domain spoofing
Domain spoofing is impersonation that makes an email or website appear to belong to a trusted domain, either by claiming that domain's identity or by using a deceptive domain that resembles it.
Ask which domain was actually used
People use “domain spoofing” for more than one technique. That matters when choosing a defense.
In exact-domain email spoofing, a message claims to come from the real organization’s domain without authorization. In a lookalike-domain attack, the attacker uses a different domain that a reader may mistake for the real one. FBI and CISA guidance includes altered spellings and different domain endings in its discussion of spoofed domains.
Neither requires taking over the organization’s real domain. Domain hijacking, where someone gains control of a domain, is a different problem. DNS spoofing is different again: it supplies false DNS answers rather than merely presenting a misleading sender or address.
Match the defense to the impersonation
SPF, DKIM, and DMARC help receiving mail systems check messages claiming to use your domain. They do not stop someone registering a lookalike domain and sending properly authenticated mail from it.
For a suspicious email, distinguish the address in the From field from the sender’s display name and any Reply-To address. A familiar name alone proves very little. The email-spoofing entry explains why authentication results also need context.
When reporting the attempt, keep the full sender address and destination URL rather than describing it only as ‘a spoofed domain.’ That gives the mail or web team something specific to investigate. For requests involving money, verify the payment change separately.