How email gets faked, and how it is stopped
Email was built before anyone thought to check who is sending. A scammer can put your name on a message the way anyone can write a false return address on an envelope. There are two tricks, and each has its own stop.
Trick one: using your exact address
The scammer sends mail that says it is from [email protected].
The stop lives on your domain. Three small DNS records (your domain’s public phone book) tell the world which servers may send as you. The last of them, DMARC, tells receiving mail systems to throw away anything else. With DMARC on and blocking, the fake never lands. Domain Security sets this up and keeps watch.
Trick two: a look-alike
The scammer registers yourcompany-ca.com, or writes your name on a free webmail address. The address is real. The name is the lie. DMARC cannot touch this one.
Two stops work here. Email Security reads every message as it arrives, spots a name that does not match its address, and tags outside mail with a banner. Phishing Training sends a practice fake every month, so the real one gets reported.