The "From:" name a recipient sees is just a header field the sending server writes — anyone with an SMTP connection can write anything there, so on its own it proves nothing about who actually sent a message.
- SPF — the real domain publishes a DNS record listing which server IPs are allowed to send as it. The receiver compares the connecting IP against that list.
- DKIM — the legitimate sending server signs the message with a private key only it holds; the receiver verifies the signature with the domain's published public key.
- DMARC — tells the receiver what to do when SPF and DKIM both fail to align with the claimed domain: allow, quarantine, or reject.
An attacker's server is never in the domain's SPF list and never holds its DKIM private key, so both checks fail and DMARC's policy blocks delivery — even though the forged "From:" address looks identical to the genuine one.