I had no idea spoofing email sender was so easy. Does anyone know of a good way to defend against this? I've always taken it for granted that if the sender was a domain that I trusted that I could trust the email itself.
Both steps aren't trivial, and configuration errors are more common than actual spoofing. DMARC is supposed to fix everything, but only if the domain owner cares enough to do more than the bare minimum setup
https://www.cloudflare.com/learning/email-security/dmarc-dki...