Email Security and Phishing Defense

A set of vocabulary flashcards covering key email protocols, security attacks, and defense mechanisms discussed in the lecture.

Mail User Agent (MUA)

The client software or web interface used by a sender or recipient to compose, send, and read email messages.

Mail Transfer Agent (MTA)

A mail server associated with a domain that uses DNS to locate recipient IP addresses and route email messages.

Simple Mail Transfer Protocol (SMTP)

The standard protocol used across hops by mail user agents and mail transfer agents to send and transmit email.

From Header

The visible sender address displayed to the recipient within an email client.

Mail From

An SMTP command indicating the return or bounce path for failed deliveries, used to authenticate the domain of the last sending mail transfer agent.

Lookalike Domain

A domain registered with minor character alterations to visually resemble a legitimate brand or organization domain in order to deceive users.

Business Email Compromise (BEC)

A cyber attack where a legitimate email account is compromised by an adversary to send fraudulent messages posing as a trusted authority, such as a CEO.

S/MIME

An enterprise-focused end-to-end email encryption protocol that relies on X.509 digital certificates issued by a Certificate Authority.

Sender Policy Framework (SPF)

An email authentication mechanism where a domain owner publishes authoritative DNS records listing IP addresses authorized to send emails for that domain.

DomainKeys Identified Mail (DKIM)

An authentication scheme using public key cryptography where a sending server signs messages and publishes a public key in DNS to verify message integrity and origin.

Domain-based Message Authentication, Reporting, and Conformance (DMARC)

An email security policy protocol that verifies whether the visible From header aligns with the authenticated Mail From or DKIM domain.

Relaxed Mode

A DMARC configuration mode where alignment checks pass even if the message originates from a subdomain of the specified domain.

Spear Phishing

A targeted phishing attack where actors monitor communication patterns and wait for specific contexts, such as an expected money transfer, to send fraudulent requests.

Passkeys

An authentication technology where users sign a challenge locally rather than transmitting credentials to a website, preventing credential phishing.