A NAME ISN’T PROOF — How to avoid getting spoofed by fake email
English narration script

Voice attribution: macOS Samantha, generated locally with /usr/bin/say.
Base voice rate: 180 wpm; uniform FFmpeg atempo: 1.202157.
All addresses and messages are fictional illustrations. No real email was accessed or sent.

[00:00.00] SCENE 1: A NAME ISN’T PROOF
The urgent message

[00:00.80 → 00:05.95] A familiar sender feels like proof. It isn’t. This urgent note claims to be billing at example dot com.

[00:06.25] SCENE 2: FROM IS A LABEL
Visible identity versus origin

[00:06.80 → 00:08.51] Follow the evidence before acting.

[00:08.86 → 00:12.71] The From line is only a display label; a sender can type a trusted-looking address there.

[00:13.01] SCENE 3: OPEN THE ORIGINAL
Evidence with provenance

[00:13.56 → 00:17.53] Open the original headers. In Gmail: three-dot menu, then Show original.

[00:17.88 → 00:22.31] Trust Authentication Results added by your receiving service, not text typed into the message.

[00:22.66 → 00:28.12] Here, S P F and D K I M pass for example dot org; D M A R C fails for example dot com.

[00:28.42] SCENE 4: SPF / THE GUEST LIST
Server permission for the envelope domain

[00:28.97 → 00:34.64] S P F checks whether this server may send for the hidden envelope domain. Here, that is example dot org: pass.

[00:34.94] SCENE 5: DKIM / THE DIGITAL SEAL
A signature tied to a domain

[00:35.49 → 00:40.82] D K I M uses a public key to verify a domain’s digital seal. This one is valid for example dot org.

[00:41.12] SCENE 6: DMARC / THE ALIGNMENT CHECK
Connect authentication to visible From

[00:41.67 → 00:46.49] D M A R C asks whether a passing S P F or D K I M domain aligns with the visible From domain.

[00:46.84 → 00:50.49] Example dot org and example dot com do not align, so this fails.

[00:50.84 → 00:54.67] Domain owners can request handling and reports; the receiver decides delivery.

[00:54.97] SCENE 7: THE LIMITS
Authentication is not a safety verdict

[00:55.52 → 01:00.05] A pass does not prove content is safe or honest. Attackers can authenticate their own domains.

[01:00.40 → 01:04.49] A failure does not prove fraud. Forwarding and mailing lists can break legitimate checks.

[01:04.84 → 01:07.55] Look-alike domains and display-name tricks still need attention.

[01:07.85] SCENE 8: PAUSE. INSPECT. VERIFY.
A safer habit

[01:08.40 → 01:12.70] Pause at urgency, passwords, or money. Inspect the actual address and original.

[01:13.05 → 01:16.16] Verify through a known app or phone number, not the message’s links.

[01:16.51 → 01:20.16] Check evidence. Verify requests. A familiar name is not enough.

[01:21.97] END