\chapter{Conclusion}
Email is one of the key ways we interact with one another, both on the job, within government, and in personal lives. However, Simple Mail Transfer Protocol (SMTP) was developed at a time when robust authentication and defense against attacks were not major concerns, so there is room for impersonation attacks, which utilize the system’s lack of verification of the sender’s identity.

In this thesis, the goal was to examine the problem of preventing email spoofing from different angles, both technically, operationally, and legally, with the use of domain-based authentication, with special emphasis on the use of DMARC (Domain-based Message Authentication, Reporting, and Conformance). The study shows how SPF and DKIM can be used, but how, on their own, they do not effectively stop domain spoofing, while DMARC provides the essential feature of identifier alignment. In terms of protocol, the thesis examines how SPF, DKIM and DMARC interact, including how decisions about authentication come from DNS TXT records, cryptographic signatures, and alignment. Meanwhile, the findings demonstrate how decisions about enforcement (rejection, quarantining, or monitoring) by domains using DMARC are crucial, including how domains with permissive policies (“\texttt{p=none}”) remain susceptible to impersonation even if there is the existence of authentication records.

To complement the theoretical analysis, this research introduced two experimental contributions.

The first contribution is a risk assessment tool for domain impersonation that assesses the risks of spoofing by analyzing DNS configuration, authentication posture, and syntactic characteristics of domain names. The tool automatically checks for the presence of DMARC, SPF and DKIM records, MX records and typosquatting signals combining these indicators into a weighted scoring model that outputs an interpretable risk score. The tool has been designed to be easy to understand, with explicit "reason tags" that allow the user to see exactly what factors contribute to the risk level being higher or lower.

The second contribution is a containerized experimental lab designed to replicate real-world email authentication scenarios. The laboratory setup has been designed to replicate a basic email ecosystem, including sender and receiver MTAs, a DNS service, as well as authentication components such as OpenDKIM and OpenDMARC. The setup has four different scenarios that test different aspects of email authentication, including: legitimate authenticated emails, spoofing blocked by DMARC enforcement, alignment-based spoofing attempts detected despite SPF success, and spoofing successfully delivered because of a permissive DMARC policy.

Results highlighted a number of important security lessons learned. The key takeaways were that SPF alone was not enough to properly secure identity since it checks against the envelope domain rather than what the user sees. DKIM has strong integrity with its cryptography but fails to prevent impersonation without proper alignment with what the user sees. Finally, it was clear that DMARC was the key to making all of these authentication mechanisms actionable at the receiving server. In other words, it was clear that with strict policies like \texttt{p=reject} in place in the lab scenarios, it was almost impossible to spoof messages at SMTP time, but monitoring-only policies failed to offer similar security benefits.

In addition to the technical part, this thesis also examined the changes in the legislation and laws regarding email security. The GDPR, the ePrivacy Directive, and the NIS2 Directive are all moving into one direction: that companies properly implement technical and organizational security measures. Although no specific authentication protocols are mandated in any of these directives, the widespread use of SPF, DKIM, and DMARC points toward a standardization that is likely becoming the norm for reasonable security in email systems. Authentication records, DMARC policies, and email headers are all potentially important pieces of evidence in legal cases regarding spoofing-related fraud and in determining if a company has taken reasonable care in protecting its communications infrastructure.

Regarding longer-term ideas, this work could expand in many directions. First, large-scale measurement studies could be conducted to understand the usage of DMARC in the real world across different domains. Second, the domain risk analysis tool could be extended to incorporate other indicators such as certificate transparency, passive DNS, and reputation-based indicators. Finally, the laboratory setup could be improved by incorporating the ingestion of DMARC reports as well as SIEM systems to resemble the real world cases.

In conclusion, this thesis highlights the central role of DMARC as a structural mechanism for restoring trust in email sender identity. While no solution can ever completely solve the problem of social engineering, the likelihood of large-scale spoofing can be greatly diminished with the proper use of domain-based authentication. Since more reliance is put on the use of email for critical communications, the strengthening of authentication systems will continue to play an integral role in the overall concept of cyber trust.


