Tagged “header-from”
13 articles
Display-name spoofing and why DMARC misses it
Friendly-from spoofing impersonates a person using a domain the attacker legitimately controls, so it passes DMARC every time by design. Here is why DMARC cannot catch it, where it shows up in BEC and CEO fraud, and the layered controls that actually mitigate it.
Read more
Turning raw DMARC XML into decisions: aggregate report analysis
A DMARC aggregate report is one of the most useful documents your domain will ever generate, and one of the least read. Publish a record with a rua= tag and, within a day or two, gzip-compressed XML files start.
Read more
Email authentication explained for beginners
Email was designed in an era when everyone on the network trusted everyone else, so it shipped with no built-in way to prove who actually sent a message.
Read more
Why your domain can be spoofed, and how to stop it
If you own a domain and have never published a DMARC record, anyone on the internet can send email that appears to come from you.
Read more
DMARC alignment explained, with examples
A message can pass SPF and verify DKIM yet still fail DMARC. The reason is alignment. This guide explains SPF and DKIM alignment, relaxed versus strict mode, and the exact DMARC pass rule, with five worked examples of messages that pass and fail.
Read more
Ten common DMARC mistakes and how to avoid them
The configuration and rollout mistakes that most often break mail or leave domains exposed, from jumping straight to p=reject to ignoring report drift, and exactly how to avoid each one.
Read more
Why email forwarding breaks SPF and DKIM
Email almost never travels in a straight line from sender to recipient. It gets redirected by university and corporate aliases, fanned out by mailing lists, scrubbed by security gateways, and quietly relayed by.
Read more
Aliases, .forward files and DMARC
An alias looks like the most innocent thing in email. You point sales@yourcompany.com at three colleagues, you set up info@ to land in a shared mailbox, a member of staff configures their university address to drop.
Read more
How invoice fraud begins with a spoofed domain
Invoice fraud usually starts with a forged sender address. Here is how exact-domain spoofing works, what DMARC at p=reject stops, and what it does not.
Read more
How email spoofing actually works
Email spoofing takes no password and no exploit: SMTP simply trusts whatever the sender types into the From field. This guide traces the mechanism from the raw SMTP conversation, through the crucial split between the envelope-from used for delivery and the header-from a human reads, to the three layered controls (SPF, DKIM and DMARC alignment) that finally make forging your domain fail.
Read more
DMARC vs SPF vs DKIM: how they fit together
SPF, DKIM and DMARC are named together so often that they blur into one thing. They are not. This is a clear comparison of what each record actually proves, why SPF and DKIM are blind to the From line your recipients trust, and how DMARC ties them together with alignment and policy.
Read more
Email authentication for schools and universities
A practical, stage-by-stage path to DMARC enforcement on a sprawling .edu or .ac.uk estate: discovery, fixing SPF under the ten-lookup limit, aligning DKIM across many departmental senders, ramping to p=reject, and the governance traps that stall most rollouts.
Read more
What is DMARC and how does it work?
DMARC is the control that stops exact-domain spoofing. Here is what it is, how it builds on SPF and DKIM through alignment, what each policy value instructs receivers to do, and how to reach p=reject safely.
Read more