You are signed in. Close

You are signed out. Close

Thank you. Your subscription has started. Close

Thank you. You will get an email when a new comic comes out. Close

We could not confirm your payment. If you paid, use the link "Sign in" at the bottom of the page. Close

Something went wrong on our side. Please try again in a moment. Close

Previous episode DKIM: how a mail server signs the emails it sends

How email works: why a fake email from your boss can reach your inbox

DMARC: how a domain tells mail servers what to do with fakes

A fake email can pass two security checks and still use a company's name. Here is the rule a company can publish so that mail servers turn such fakes away.

  1. 1 Rono now sends his fakes to the customers of the workshop too. At a customer's mail server, one arrives beside a real email from Miva: the same From line, and two passed checks on each.Miva's real emailFrom: miva@woodshop.exampleSPF and DKIM pass,for woodshop.exampleRono's fakeFrom: miva@woodshop.exampleSPF and DKIM pass,for quickpost.examplea customer'smail server

    Rono now sends his fakes to the customers of the workshop too. At a customer's mail server, one arrives beside a real email from Miva: the same From line, and two passed checks on each.

  2. 2 The server lets both through. Each passed two checks, and nothing tells it that only one of them really comes from the workshop.a customer'smail serverTwo passes each.Both go in.the customer's inbox?

    The server lets both through. Each passed two checks, and nothing tells it that only one of them really comes from the workshop.

The rest of this episode is for subscribers

Subscribe to read every premium episode. You can cancel when you want.

Paid yearly: $99 instead of $119.88

Next episode Display names and lookalike domains: why a fake email can pass every check

Share this comic

More comics