Blog
Explainers
Fromenance writes about communication provenance for people who already know what DMARC is. Short, specific, and quotable, with no campaign write ups until there are real campaigns to write up.
Communication provenance explained
Communication provenance is sender side evidence that an institution issued a specific communication to a specific recipient. Fromenance explains the primitive, how it differs from authentication and detection, and why it produces a definitive answer.
What survives an email forward
Fromenance matches forwarded messages against a communication provenance registry, so it matters exactly what Gmail, Outlook, Apple Mail, and a Proofpoint gateway do to a message on the way through. Here is what survives and what does not.
When attackers copy the verify footer
Attackers will copy an institution's verify footer into their lures. Fromenance communication provenance is designed for that: the code is bound to one registration and one recipient, so a copied footer fails and hands the lure to the fraud team.
Why DMARC passes on phishing
Fromenance explains a communication provenance basic: a lure from a lookalike domain passes SPF, DKIM, and DMARC because those controls authenticate the attacker's domain, not your message.