Compare
Fromenance vs DMARC and BIMI
If you have DMARC at reject, good, keep it, and Fromenance depends on it. Communication provenance answers a different question than DMARC does: DMARC tells a receiving server that a message really came from your domain, and Fromenance tells your customer whether you actually sent that message to them. A lure from a lookalike domain passes SPF, DKIM, and DMARC because it really did come from the lookalike, and that is exactly where your customer needs the second answer.
Side by side
What each one does
| Question | DMARC (with SPF, DKIM, BIMI) | Fromenance |
|---|---|---|
| What does it check? | A domain. SPF says the sending server is allowed to send for the domain; DKIM signs parts of the message for a signing domain; DMARC insists the two line up with the visible From. | A communication. Did this institution send this message to this person at this time? We check a verify code, a hash of the recipient's address, and a fingerprint of the text against your registry. |
| Who sees the result? | Receiving mail servers, and you, through aggregate and forensic reports. The customer sees nothing, unless BIMI is set up and their client shows a logo. | The customer, in a reply from your domain or on your verify page, in seconds. |
| Does it stop lookalike domains? | No.No. A message from jtmerlin-secure.com with correct SPF, DKIM, and DMARC for that domain passes. DMARC only governs your real domain. | Yes.A lookalike message is not in your registry, so it comes back Not verified, and the lookalike domain becomes an indicator. |
| Does it stop free mail and compromised accounts? | No.No. Mail from a Gmail account, or from a vendor whose account was taken over, authenticates cleanly for that domain. | Yes.Same answer: not registered, so Not verified, and the sending address is pulled out as an indicator. |
| Does it handle display name impersonation? | No.No. DMARC never looks at the display name. | Yes.The display name does not matter to us either way. Only the registry counts. |
| What does the customer learn? | Nothing they can act on. Authentication results live in headers most clients hide. | A locked verdict, a next step, and your fraud contact. |
| What do you learn? | Aggregate reports about who is sending as your real domain. Genuinely useful for catching unauthorized senders and misconfigured vendors. | Every lure a customer doubted, with its indicators, delivered by the person it targeted. Replay flags show you which templates are being copied. |
| What does it take to deploy? | DNS records and a policy ramp from none to quarantine to reject, which usually means months of finding out who sends on your behalf. | One TXT record, one redirect rule, one footer, one registration path. We require the forwarding hop to pass DKIM or ARC, so we build on your DMARC work rather than replacing it. |
The gap
Why a lure passes DMARC
DMARC is good at what it does. It stops direct spoofing of your protected domain, and attackers noticed years ago.
What they send instead
- Lookalike domains: bank-security.com, bankalerts.net, Unicode homoglyphs
- Free mail accounts with your display name
- Compromised legitimate domains, including your vendors'
- Legitimate SaaS sending infrastructure with your logo pasted in
- SMS, QR codes, and images that never touch DMARC at all
Each of these authenticates correctly for the domain it was sent from. DMARC is doing its job. The job is just not your customer's question.
What BIMI adds, and what it cannot
BIMI puts your logo next to messages that pass DMARC with a strict policy, in clients that support it, if you hold a verified mark certificate. It is a real positive signal, and some customers in some clients will notice it.
What it cannot do is give the customer anything to do about a message that lacks the logo, which is every lure. And logos are exactly what attackers paste in. We give the customer an action instead: forward it, paste it, get an answer.
Both
Why you want both
We are built on your DMARC work. We only process mail to your tenant inbox when the forwarding hop passes DKIM or ARC for a domain you own, and the reply identity we recommend is a DKIM signed subdomain. So keep DMARC at reject, and add the layer your customer can see.
Start with one stream and a 60 to 90 day pilot.
Pick your fraud alerts or your transaction alerts, the messages your customers already squint at. At the end you get a written report: how many people asked, what they were told, which campaigns turned up, and what your existing feeds missed.