How Phishing Works, and How SPF, DKIM and DMARC Fight Email Spoofing

Why it is so easy to fake the sender of an email, what phishing messages have in common, how the three email authentication standards SPF, DKIM and DMARC let receiving servers catch forged mail, what they cannot stop, and the habits that protect you anyway.

0:31 What phishing looks like

Phishing tries to steal personal information or break into accounts with deceptive messages and sites that imitate ones you trust, usually with urgency.

Sources: Google Help (original)

1:43 Why email is so easy to fake

The basic mail protocol, SMTP, has no built-in way to authenticate the sender, so the From line can be forged.

Sources: Cloudflare Learning Center (original) · RFC 7208 (original)

2:51 SPF and DKIM: a guest list and a seal

SPF lets a domain publish which servers may send its mail; DKIM adds a cryptographic signature checked against a public key in DNS.

Sources: RFC 7208 (original) · Google Workspace Admin Help (original) · RFC 6376 (original) · Cloudflare Learning Center (original)

4:23 DMARC: what to do when the check fails

DMARC ties SPF and DKIM to the visible From address and lets the domain owner ask receivers to do nothing, quarantine or reject failing mail, with reports back.

Sources: RFC 7489 (original)

5:56 What authentication can't stop

Authentication does not stop lookalike domains or mail from real accounts that were taken over, so personal habits still matter.

Sources: Cloudflare Learning Center (original) · Google Help (original)

Follow the show in your podcast app to get each new episode as soon as it is out.

Produced by Juan Pablo.