Blog
Notes for people who already know what DMARC is
These are the things we find ourselves explaining on the first call about Fromenance, written down once. Communication provenance is a new enough idea that most of the questions are about the mechanics, so that is mostly what is here: short, specific, and quotable. No campaign write ups until there are real campaigns to write up.
The phone call my mother made
Fromenance exists because of one email, one copycat page, and one phone number. The founder's account of the scam that took thousands of dollars from his mother, and why communication provenance is the answer he could not find that day.
When attackers copy the verify footer
Attackers will copy an institution's verify footer into their lures. Fromenance communication provenance is designed for that: the code is bound to one registration and one recipient, so a copied footer fails and hands the lure to the fraud team.
What survives an email forward
Fromenance matches forwarded messages against a communication provenance registry, so it matters exactly what Gmail, Outlook, Apple Mail, and a Proofpoint gateway do to a message on the way through. Here is what survives and what does not.
Why DMARC passes on phishing
Fromenance explains a communication provenance basic: a lure from a lookalike domain passes SPF, DKIM, and DMARC because those controls authenticate the attacker's domain, not your message.
Communication provenance explained
Communication provenance is sender side evidence that an institution issued a specific communication to a specific recipient. Fromenance explains the primitive, how it differs from authentication and detection, and why it produces a definitive answer.