Stop the Spoof: SPF, DKIM and DMARC for a Real Business

<p>Two buyers of Sahyadri Foods, a fictional Pune food exporter, paid a fake invoice that came "from" the finance head's address. The company's domain had no email authentication at all.</p><p>In four lessons you learn how email is sent and why the From address can be forged, then publish SPF (who may send), DKIM (signed messages) and DMARC (alignment and policy) records for the company's real senders: its mail host, a marketing platform and an invoicing server. You run spoof tests until real mail is delivered and spoofs are rejected, and you learn to read message headers to tell an authentication failure from a lookalike domain and a Reply-To trick.</p><p>Everything runs in Bartman's in-browser Email Security Lab against a simulated DNS generated for you. Part of the Bartman Cybersecurity track (Professional Certificate in Cybersecurity, LSBF).</p>

Tools: Email security, SPF, DKIM, DMARC, DNS, Phishing analysis