---
title: "Email Impersonation"
slug: "email-impersonation"
updated: 2026-09-03T13:01:40Z
published: 2026-09-03T13:01:40Z
canonical: "help.silentpush.com/email-impersonation"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.silentpush.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Email Impersonation

The Email Impersonation query detects domains that target organizations by manipulating MX (Mail Exchange) records, where attackers disguise malicious emails as originating from legitimate mail servers.

### Execute an Email Impersonation Query

1. Go to **Reconnaissance > Email Impersonation**.
2. Enter a domain name in the **Domain Name** box (wildcards are not supported).
3. Click **Search**.
4. On the results page, click **Save** to store the query (this also saves your input parameters). You can then enable scheduling via the schedule menu if desired.

### Understand Email Impersonation Results

Results are displayed in an Explore table with the following columns:

- **Query**: Domain the result pertains to.
- **Risk Score**: Silent Push Risk Score.
- **Answer**: MX record.
- **First Seen**: Date and time the MX record was first observed.
- **Last Seen**: Date and time the MX record was last observed.
- **MX Hash**: Hash value of the MX record.
- **MX Server Density**: Density of the MX server.
- **WHOIS Created Date**: Domain creation date.
- **WHOIS Registrar**: Registrar of the domain.

### Monitor and Save Results

#### **Monitoring**

Click **Monitor** on the results screen, enter a **Monitor name** and **Description**, then click **Save** to receive daily email alerts.

#### Save to a Feed

1. Left-click one or multiple results.
2. Select **Save to** in the top-right of the results screen.
3. Use the contextual menu to save to an existing or new collection/feed.

##