Generally speaking, yes, email spoofing can be traced. This is due to a security protocol known as Sender Policy Framework (SPF), which can locate the senderâ€s IP address.