The attacks that pass SPF, DKIM and DMARC, and the habits that catch them anyway.
It is being written. The outline below is what it will cover, and it is unlikely to change much. There is no enrolment and no date — when it is ready it will be on this page. Several of the lessons are built around tools on this site that already work, so you can practise the measurements today.
If you need this capability now rather than later, Advanced email security is the service that covers it, or talk to us.
Everyone who receives email at work, with a longer final module for the finance and payroll staff who are targeted specifically.
Foundation. No prior experience assumed. Written for people whose job is not IT.
No prerequisites. Nothing is assumed beyond using a computer at work.
3 modules, 10 lessons, 1 h 33 m of material. The times are the sum of the lessons rather than a round figure.
SPF, DKIM and DMARC authenticate a domain. They say nothing about whether the sender is honest, and nothing at all about the name your mail client shows you.
What each one actually tests, without the acronym soup.
Registering a domain you control and configuring it properly is cheap. Authentication then confirms you are who you say you are — which is the problem.
Finding the raw headers in your own mail client, and the three lines worth looking at.
Almost everything that arrives is one of these wearing different clothes.
One character, a different top-level domain, or a subdomain that reads like the real thing.
Most clients show only the name. A name can be any text at all, including somebody else’s address.
The message comes from the real domain; the reply does not go back to it.
Reply-chain hijacking, where the attacker joins a genuine conversation from a compromised mailbox.
The payment-change request is the single most expensive message an organisation receives, and it is the one most easily defeated by process.
The research, the timing, the pressure, and why it usually arrives on a Friday.
Out-of-band confirmation on a number you already had — and why confirming by email is not confirmation.
The first hour, who to call, and what the bank can still do.
Format. Short written lessons with worked examples from real headers, and a practical exercise using this site’s own header analyser. Delivery mechanism is not built yet.
These tools run the same checks the course teaches, and they work today. No account, and the ones marked as running in your browser send nothing anywhere.
Getting to an enforced policy without losing legitimate mail on the way.
Course outline ⟶Identity is the perimeter now. This is how to configure it without locking everyone out.
Course outline ⟶Addressing, DNS, DHCP and NAT — and a method for finding which of them is broken.
Course outline ⟶This course exists because the work behind it is work we do. If you need the result rather than the skill, advanced email security is the service that covers it.