Overview
Spoofing is forging the visible sender of an email: putting a name or address on the “From” line that the sender has no right to use. The “From” line is just text, so nothing prevents the attempt. What can catch it afterward is verification.
How attackers abuse it
A spoofed message borrows an identity you already trust. It might claim to be your bank announcing a security problem, a coworker asking a quick favor, or a service you use confirming an order. The borrowed name is the whole trick: the message earns the first click with someone else's reputation.
Spoofing is rarely the end goal. It is the delivery vehicle for phishing and brand impersonation, which supply the ask that follows the borrowed trust.
How it gets caught
The SPF, DKIM, and DMARC checks exist largely for this moment. A message that claims a well-known sender but fails that sender's own authentication is showing the classic signature of a spoof: the claimed identity and the verified identity do not match.
Spoofing is a forged “From” line. The authentication checks catch exactly this: a claimed identity that does not match the verified one.
What Sieve shows you
When a message is filed as Malicious because its claimed sender could not be verified, your dashboard shows that reason in the vocabulary of this page. The message sits under a label in your Gmail, never deleted, so you can always inspect it.
If the flag is wrong, drag the message back to your inbox or restore it from the dashboard. One correction restores the message and teaches your own filter about that sender.