Interactive explainer · Secure

How someone sends email pretending to be you.

Anyone can type your name into the sender line. SPF, DKIM and DMARC are how the receiving mail server checks whether the message really came from you. Switch the settings below and see what changes for an attacker, and for your own team.

Who is sending

Choose a sender

Someone spoofing youYour accounts team

From line shown to the recipient: accounts@your-company.example

Pipeline

What happens

The message claims to be from you

Someone sends an email from their own server, but the sender line says "your-company.example". Nothing stops them from typing that. The receiving mail server has to check.

Your settings

SPF lists your mail providersYour DNS record names the servers allowed to send as your domain.Outgoing mail is signed with DKIMYour providers sign mail with a key whose public half is in DNS.

DMARC policy

No DMARC recordp=none (monitor)p=quarantinep=reject

Results at a glance

Outcome for each sender with the current settings
Sender	Outcome
Someone spoofing you	Rejected
Your accounts team	Delivered

Try turning SPF and DKIM off, then set the policy to p=reject. Your own mail is usually what breaks first.

A simplified model for learning. Real mailbox providers also weigh reputation and content, so DMARC is the core check, not the whole story. The example domain is fictional.