Why the visible sender is easy to change
Email separates the message a person reads from the instructions computers use to deliver it. The visible From field is part of the message’s contents, much like a return address written on a letter. In email’s basic design, a sending computer can put one address there while sending the message through a different system. The receiving service needs a way to check that claim; the text alone cannot do it.
That separation made email flexible: organizations can send mail through different servers and services while showing a consistent address. But it also means a familiar name or address is not, by itself, evidence that the apparent sender controlled the account or approved the message.
What the checks actually establish
SPF lets a domain publish which mail servers are allowed to send mail for it. DKIM adds a digital signature to a message, allowing the receiver to check that the signature matches a domain and that signed parts of the message were not altered in transit. DMARC connects those checks to the address recipients see: it asks whether an authenticated domain matches the visible From domain, and lets the domain owner specify how failures should be handled.
Together, these checks make it harder to impersonate a domain that has configured them. They do not certify the human being behind a message, and they cannot rule out mail sent from a compromised account or an authorized but misused service. The practical distinction is that a forged label can be written by anyone; a valid domain check requires control of the domain’s sending arrangements. A convincing From line is still only a claim until the receiving system checks it.
