An email in your inbox says it came from you. You didn’t send it.
The sender line shows your own name and your own address. You pay for email, it filters junk, and mostly that is handled.
Email lets the sender line say whatever the sender types. Microsoft calls this spoofing: the message appears to come from someone or somewhere other than the real source. A message that shows your address has two possible origins, and they need different responses.
Two ways your own address ends up on a message to you
A forged sender. The message was sent from somewhere else, with your address typed into the From line. Microsoft’s documentation calls the case where sender and recipient share a domain “self-to-self” spoofing. Your account was never opened.
Your own mailbox. Someone signed in as you, or a program with access to your account sent it. Then the message is real mail from your account, and a forged-sender explanation does not fit.
Checks that separate the two
- Search Sent Items and Deleted Items for the subject line and for a phrase from the body. A copy in either one points to the account.
- Look at your inbox rules and forwarding for anything you didn’t create. The FTC lists forwarding rules, unfamiliar sent messages, and messages in the deleted folder as the places to look.
- Open the message header and find the line that begins Authentication-Results. How you open it varies by mail program and version.
- In that line, look for compauth=fail. For a message from your own domain to you, Microsoft documents the reason code as reason=6xx, and the companion header X-Forefront-Antispam-Report carries CAT:SPOOF. That is Microsoft 365 recording that it judged the From line forged.
- Look at your account’s sign-in history for a place, device, or time you don’t recognize.
The version that quotes your password
Some of these messages say the sender hacked your computer, recorded you, and will send it to your contacts unless you pay in cryptocurrency. The FTC’s answer: “Stop. Don’t pay anything. Delete the message. It’s a scam.” Of the claim to have webcam or computer access, it says “That’s all talk.”
The FTC also notes the sender may really know one of your old or recent passwords and uses it as proof. That usually means your address turned up in a data breach somewhere. If the password is one you still use, change it on that account and anywhere you reused it. Report the message at ReportFraud.ftc.gov.
What these checks do and do not show
Microsoft states that a failed authentication check does not by itself block a message, so a forged message can reach your inbox without anyone having touched your account. Arriving in the inbox is not evidence of a break-in.
The reverse also holds. A clean Sent folder, no unknown rules, and a header that flags the sender as forged fit the forged-sender explanation. They do not prove it, because a person with access to the mailbox can delete what they sent. Sign-in history and rules are what carry weight there.
A header can only show what the receiving system recorded. If your mail is hosted somewhere other than Microsoft 365, the header fields and reason codes differ.
What to do with the message
If your customers or coworkers received the same message, tell them by phone that it did not come from you. Those recipients are the ones who can’t see your Sent Items.
- Don’t click a link or open an attachment, and don’t reply.
- Keep the message instead of deleting it. The header is the evidence of where it came from.
- Mark it as junk or phishing in your mail program, and report it at ReportFraud.ftc.gov if it asks for money.
- If the message asks the reader to pay or to change payment details, call the person on a number you already had.
What we check with you
We read the header with you, then the mailbox rules, forwarding, and sign-in history, and the mail records on your domain that tell other systems who may send as you. A person reads the results and tells you what pointed to a forged sender, what pointed to the account, and what we couldn’t tell, with dates.
The sender line can be typed by anyone, so the header and your Sent Items decide which of the two this is.
Related
Sources
Talk to a person about what you noticed.
Call (•••) •••-••••
Kristina or Anne will answer. Available during US Eastern time.
While you wait: run the Reveal Scan on the computer you use for this.
Run the Reveal Scan on that computerThe Reveal Scan shows every problem it finds, with no charge and no credit card needed. Step-by-step instructions for fixing them are in the detailed report, which is paid, and you’ll see its price before you buy. It reads one Windows computer at a time and can’t see a mailbox.
Or ask for a call back. Tell us which computer or mailbox, and what you noticed.
Request a call back
Written by Craig Peterson, 35+ years successfully running IT and security for businesses. Last reviewed October 27, 2026.