How anyone can pretend to be you, and what stops them
Email was never built to prove who a message is really from. A handful of DNS controls fix that. Here's what each one does, why it matters, and how they fit together, without the jargon.
DNS controls that stack into one defence
Visible From line they all exist to protect
Checks DMARCER runs to grade them for you
The problem: a forgeable “From” line
By default, anyone sending email can put any address in the “From” field, including yours. Nothing in the original email standard checks it. That single gap is what phishing, invoice fraud and brand impersonation all rely on: the message looks like it came from you, so the person reading it trusts it, clicks the link, or pays the invoice.
The fix isn’t one switch. It’s a small stack of DNS-based controls that, working together, let receiving mail servers verify a message, decide what to do with the fakes, and tell you what they saw. None of them is hard once you understand what each one is for, which is exactly what this page is here to do.
Why this matters, whoever you are
- Running your own domains? You learn what each record does and why a gap leaves you exposed. No email-security specialist required.
- Managing clients? You get a clear, shared vocabulary you can use to explain the risk and the fix to every client you protect.
The layers, and how they stack up
Think of it as a stack. The first three controls prove who’s allowed to send mail as you. The next three protect mail coming to you while it’s in transit. DNSSEC makes the DNS that underpins all of it tamper-evident. And once you’re enforcing, BIMI turns that hard-won posture into your logo in the inbox. Each one has a dedicated deep-dive: follow the links to go further.
SPF →
Declares which servers are allowed to send mail as your domain, so unknown senders stand out.
DKIM →
Adds a cryptographic signature that proves a message genuinely came from you and wasn’t tampered with on the way.
DMARC →
Ties SPF and DKIM together, checks they align with your visible From address, tells receivers what to do with fakes, and reports back to you.
MTA-STS →
Forces mail coming to your domain over an encrypted connection, so it can’t be quietly downgraded or intercepted.
TLS-RPT →
Reports back to you whenever secure delivery to your domain fails, so a broken encrypted path doesn’t go unnoticed.
DNSSEC →
Makes your DNS itself tamper-evident, so the records every other control depends on can’t be silently forged.
DANE →
Pins your mail server’s certificate in DNSSEC-signed DNS, so senders can prove they’re reaching the real you over genuine encryption.
BIMI →
The reward for enforcing DMARC: your verified brand logo shown beside your mail in supporting inboxes, so genuine messages stand out.
Proving who’s allowed to send in your name
The first job is to stop strangers sending mail that looks like it’s from you. SPF publishes the list of servers permitted to send as your domain. DKIM goes further, attaching a cryptographic signature so a receiver can prove the message is really yours and that nobody altered it in transit.
DMARC is the keystone. It ties SPF and DKIM together and adds the crucial test the other two skip on their own: alignment, checking that the thing which authenticated actually matches the domain in the visible From address an ordinary person reads. It then tells the world what to do with mail that fails, and sends you reports on everyone trying to send as you.
- SPF: which servers may send as your domain
- DKIM: a tamper-proof signature that proves a message is yours
- DMARC: alignment to your visible From address
- DMARC policy: tells receivers what to do with fakes
- DMARC reports: show you who’s sending in your name
Protecting the mail coming the other way
Authentication stops people forging your address. But mail arriving at your domain needs protecting too. Email can fall back to an unencrypted connection if the secure one isn’t enforced, and an attacker in the middle can deliberately trigger that downgrade to read or alter messages.
MTA-STS closes that door by forcing inbound mail over TLS, so it can’t be quietly downgraded or intercepted. TLS-RPT is its early-warning system: it reports back to you whenever secure delivery fails, so a broken or attacked encrypted path surfaces instead of failing silently.
- MTA-STS: forces inbound mail over encrypted TLS
- Stops silent downgrade and interception attacks
- TLS-RPT: reports back when secure delivery fails
- Turns a silent failure into something you can act on
The foundation: tamper-evident DNS
Every control above lives in DNS, the records that tell the world how to find and trust your domain. If an attacker can forge those records, they can undo the lot. DNSSEC is the foundation that prevents it: it makes your DNS itself tamper-evident, cryptographically signing your records so a receiver can detect if anyone has altered them in transit. It doesn’t authenticate mail directly, but it protects the ground that SPF, DKIM, DMARC and MTA-STS all stand on. See how DNSSEC works →
Why it takes all of them together
No single control is enough on its own. SPF can be bypassed by forwarding; DKIM proves a message is genuine but says nothing about the visible From address; DMARC only works once SPF and DKIM are aligned beneath it; and none of it matters if mail is intercepted in transit or your DNS can be forged. Stacked together, they stop attackers spoofing you and protect mail in transit, which is why posture is best read as one picture, not six unrelated checkboxes.
If you run your own domains
You come away knowing what each record is for and where a missing one leaves you exposed, enough to know the right questions to ask and what “good” looks like, without needing a specialist on staff.
If you manage clients
You get a plain-English way to explain the risk and the fix to non-technical clients, turning email authentication from an abstract worry into a clear, sellable piece of work.
Where to go from here
Start with DMARC →
The keystone that ties it all together.
Industry benchmarks →
See how your sector scores on all of this.
Check your domain →
See which controls you have, free, in seconds.
See which of these you already have
Understanding the problem is free. Run a free check to see exactly which controls protect your domain today, and where the gaps are.
Check your domain