Sigil

When Sigil was twenty, she was the junior signal officer on a convoy of four merchant ships under naval escort. They were running goods through a stretch of water known for piracy. A vessel approached flying the convoy commodore's recognition signal. The senior signal officer accepted it without verification. The vessel turned out to be pirates with a stolen codebook. Two of the four merchants were boarded and lost.

Sigil blamed herself for not insisting on the secondary verification. She'd known the procedure. She'd been told not to challenge a senior officer's call. She didn't push. People died.

She doesn't tell this story often. But she runs every signal three times now, and she doesn't care who finds it tedious. The cost of the cheaper version is a story she already knows.

Recent. A small ecommerce sender she was advising had set up SPF and DKIM but kept putting off DMARC. They thought they were "mostly authenticated." Their excuse was always "we'll do it next month."

Then a phishing campaign started. Someone had built a near-perfect copy of the sender's order-confirmation emails, complete with a fake login page, and was sending it to the sender's actual customer list (likely scraped from a breach). Customer support was flooded with confused complaints. The brand's name was getting dragged.

Sigil walked them through DMARC setup over a single afternoon. They published p=reject the next morning.

By that evening, the phishing campaign had collapsed. Mailbox providers that respect DMARC (which is most of them now) started rejecting the spoofs at the gate. The phisher moved on within a week to softer targets.

The lesson Sigil teaches now: DMARC is not optional. It's the only thing that makes "this is really us" a verifiable claim instead of a hopeful assertion. Without it, anyone with a free email server and a screenshot can wear your face.

When you send an email, the receiver has to make a decision. Is this real? Did it actually come from the company it says it came from? Or is it from a spoofer wearing the company's face?

Email authentication is the system that lets the receiver answer that question. Without it, every email is a stranger in a uniform. The uniform might be real. It might be borrowed. The receiver has no way to tell.

Authentication has three parts. They're abbreviated, which is why they sound intimidating, but each one does a single, simple job.

SPF (Sender Policy Framework). This is the public list of which mail servers are allowed to send email for your domain. You publish it as a small DNS record. When a receiving server gets an email claiming to be from your domain, it checks: "did this email come from one of the servers on the list?" If yes, SPF passes. If no, SPF fails.

That's all SPF does. It's a guest list at the door of a club. Either the sending server is on the list, or it isn't.

DKIM (DomainKeys Identified Mail). This adds a cryptographic signature to every outgoing email. You publish a public key in your DNS. The sending server signs each email with the matching private key. The receiving server checks: "does this signature match the public key?" If yes, the email's content hasn't been tampered with in transit, and it really came from someone holding your private key. If no, something's off.

That's all DKIM does. It's a wax seal on a letter. Either the seal is intact and matches your stamp, or it doesn't.

DMARC (Domain-based Message Authentication, Reporting & Conformance). This is the policy and the reporting layer on top of SPF and DKIM. It tells receiving servers: "if an email claiming to be from my domain fails SPF and DKIM, here's what I want you to do with it." The options are none (do nothing, just monitor), quarantine (send it to spam), or reject (refuse it entirely).

DMARC also tells receivers where to send daily reports about what they're seeing. Those reports are how you find out who's spoofing you, where they're sending from, and whether your own setup is working.

That's all DMARC does. It's the policy poster at the door that says "if anyone shows up without a guest list pass and a verified seal, throw them out, and tell me about it."

Three parts. SPF lists who can send. DKIM signs each message. DMARC enforces the policy and reports the results.

I tell every sender I work with: SPF, DKIM, and DMARC are not advanced moves. They're the floor. They're what every other email best practice assumes you've already done. List hygiene matters less if anyone can pretend to be you. Beautiful design matters less if your customers can't trust the From line. Authentication is the load-bearing wall.

It takes about an afternoon to set up the first time. Less if you have access to your DNS and your ESP's documentation.

Most senders never make the afternoon for it. The ones who do never look back.

You're already on the right ship for reading this. Now go publish your SPF record.

— Sigil

DMARC has three policies. They sit at three different levels of enforcement. You don't pick one and stick with it. You walk through them in order, in sequence, over weeks. Skipping the early stages is how senders break their own legitimate mail.

p=none. Monitor mode. Receivers do nothing different. Everything that fails authentication still gets delivered as if DMARC weren't there. The only thing this policy does is start sending reports back to you about who's claiming to be your domain and whether they're passing or failing.

p=quarantine. Soft enforcement. Receivers send authentication failures to the spam folder. Nothing gets blocked outright, but anything claiming to be your domain that can't prove it ends up where most people don't look.

p=reject. Hard enforcement. Receivers reject authentication failures at the gate. The recipient never sees the email at all. Spoofers fail. Phishers fail. Misconfigured legitimate mail also fails, which is why you cannot start here.

You start at none. You move to quarantine. You finish at reject. The whole journey takes about 8-12 weeks for most senders, longer for big companies with sprawling sending infrastructure.

The whole journey is 8-12 weeks. The cost is mostly attention, not money. The payoff is permanent. Once a domain is at p=reject and stable, the spoofing problem is functionally solved for that domain.

Most senders never get there. The ones who do never look back.

— Sigil

DMARC at p=none does nothing on its own.

I'll say that twice because senders forget it. DMARC at p=none does nothing on its own. It doesn't block spoofers. It doesn't quarantine bad mail. It doesn't stop phishing. It is monitoring mode. Its only job is to generate reports.

If you set up DMARC at p=none and never read the reports, you've published a security camera and never looked at the recordings. The camera is on. The recordings exist. Nobody is watching them. The break-in happens. The footage is fine. Nobody knows.

That's where most senders are right now. They published p=none. They got a green checkmark in some auth-checker tool. They moved on. They are now exactly as exposed to spoofing as they were before, except they pay the DNS lookup cost.

If you have DMARC at p=none and no reporting, you have homework. Go set up a parser. Then you can actually call it monitoring.

Until then, the camera is on. Nobody is watching.

— Sigil