Explain like I'm five · Security

What is Email Security?

Email security (SPF, DKIM, DMARC), told as a story about three stamps only the real post office can press.

from: the Royal Postthe thief just writes itcastle mailboxa letter from the Royal Post!the name on the envelope is not a seal

Anyone can write 'the Royal Post' on an envelope.That is what makes a fake letter dangerous. The sender's name is just handwriting. A thief can write it too.

from: the Royal Postsent by the real post=from: the Royal Postsent by the thiefthey look exactly the same…the doorkeeper can't chooseworse — fakes go out to the village in our name too

Looking at the envelope alone, nobody can tell.No matter how sharp the doorkeeper is, handwriting isn't enough. Worse, the thief also sends fakes to the village in our castle's name — and then nobody trusts our real letters either.

① the courier listWHO MAY DELIVERcourier A ✓courier B ✓no one elsewho is allowed to send② the sealonly the post can press it③ the instructionsIF THE SEAL IS WRONGleave itset it asidethrow it awaywhat to do if it's wrongall three are pinned at the village desk ahead of timeanyone who asks can look them up

Email security is three stamps the post office puts up ahead of time.A courier list, a seal, and a note. All three are pinned at the village desk, so anyone can look them up.

The courier listonly A and B may carry this post's letters
The sealonly the post can press it; it breaks if opened
The noteif wrong: leave it, set aside, throw away
The mailbox keeperchecks all three on every letter
Royal PostTHE DOORKEEPER'S CHECKis the courier on the list?is the seal real?if not → follow the noteeither one matching is enoughdeliver!quarantinerejectif wrong, do what the note saysthe doorkeeper reads the seal, not the handwriting

The keeper checks the list and the seal on every letter.If the courier is on the list or the seal is real, it passes. If neither, the keeper does what the note says — leave it, set it aside, or throw it away.

our castleour note says: throw it awayfrom: our castlesends fakes in our namefakes in our name get thrown away at every castle in the village

Fakes in our name get thrown away at every castle in the village.The stamps protect our name, not only our castle. But a letter with every stamp correct can still carry a lie — that part is taught in the thief lessons.

In one breath

Email security = three stamps the post office pins at the village desk — who may send (the list), is the seal real (the seal), what to do if wrong (the note). The keeper checks every letter.

SPF lists the servers allowed to send mail for a domain, DKIM is a digital signature only the domain owner can make, and DMARC is the policy for when both fail (none, quarantine, reject). All three are published as DNS records and checked by the receiving mail gateway.

When grown-ups say it

SPF
Who may send. The list of couriers allowed to send letters in our castle's name. Pinned at the village desk.
DKIM
The seal only the post can press. Pressed to match the letter's contents, so it breaks if anyone edits it on the way.
DMARC
What to do if it's wrong. Our castle picks one of: leave it, set it aside, throw it away. It also gets reports of what happened.
Spoofing
Writing someone else's name on the envelope. The thief sending fakes in our castle's name. Exactly what the three stamps stop.
Email gateway
The one who checks every letter. Reads the stamps, checks for bugs, sets the odd ones aside.
Quarantine
The set-aside box. Not thrown away, but not delivered either. A person looks later.
Phishing
A letter pretending to be the post. Before the stamps, we trusted handwriting alone. → the letter that pretends to be the post
Security awareness training
Staying wary even when every stamp is right. Even a genuine letter can carry a lie. → the thief lessons everyone attends
Next story
The Guard with the Bug Cards →
Want another term as a picture book? Request →