RME-136 · story draft · parked until the cast is chosen
Who's sending as Sally?
Parked draft. Names and looks are not decided yet, so the ones here are working ones only. Vy picks the real ones on the character sheet first, then this story is redrawn with them.
A seven-episode investigation. Sally thinks an impostor is sending email in her name. The truth is less sinister and more useful: her own forgotten tool, sending without a badge. Every email fact below comes from our Email Almanac, with its number, so a video can quote it exactly.
Your job here
- Look at: the seven episodes of "Who's sending as Sally?", then the cast who play them.
- Skip: the characters waiting for their own story for now.
- Your choice: yes or change to the story, yes or change to each character, and an answer to the three gaps.
The story
1. Hey buddy
Dee catches Sally mid-send. "Hey buddy, your email's not authenticated, so no one knows it's actually you."
The picture: Sally's envelope arrives at Phil's door with no badge on it. Phil turns it over, then picks up an identical envelope with the same name. He cannot tell them apart.
From the Almanac
- 023.002.001 The original email protocols never required sender verification. SPF, DKIM and DMARC alignment are what let receiving servers detect spoofed mail. What is email spoofing?
- 003.003.033 Gmail and Yahoo's 2024 sender rules require DMARC alignment for anyone sending more than 5,000 messages a day to their users. Why Gmail and Yahoo require DMARC alignment for bulk senders?
2. Someone is sending as me
Marina shows Sally an email from Sally that Sally never wrote. Sally is sure: an impostor is sending as her. The suspect appears at the edge of the frame, in Sally's own outfit.
The picture: Sally and Imma stand side by side, same jacket, same stripes. Only the shoes differ, and nobody is looking at shoes yet.
From the Almanac
- 023.002.001 Spoofing is forging sender information so a message appears to come from a trusted person, brand or domain it did not come from. What is email spoofing?
- 023.002.010 No. Neither SPF nor DKIM alone stops spoofing of the visible From address. DMARC closes the gap by requiring alignment and a published policy. Can SPF or DKIM alone stop spoofing?
3. The stakeout
Dee does not accuse anyone yet. First, watch. Sally publishes a DMARC record in monitor mode, and every day the mailbox providers send her a report.
The picture: A lantern goes up over Phil's door. Mail keeps flowing through exactly as before, and each morning a report envelope lands on Sally's desk.
From the Almanac
- 003.003.001 A minimal monitoring record (p=none with an rua address) starts collecting reports without affecting mail flow. What is DMARC?
- 003.003.009 Aggregate reports arrive as a daily summary, typically, though providers set their own schedules. What is a DMARC aggregate report (RUA)?
4. The lineup
The first report is a lineup of every source that sent email using Sally's domain. Her newsletter platform, her shop, and one line she cannot explain.
The picture: A police lineup of senders, each holding a sign with how many messages it sent and whether it passed. One sender at the end has no badge at all.
From the Almanac
- 003.003.009 For each sending source the report lists the source IP, how many messages, SPF and DKIM results, the alignment outcome and the policy applied. It is how you discover every service sending as your domain. What is a DMARC aggregate report (RUA)?
- 003.003.019 An IP you cannot explain is either a forgotten sending service or someone trying to spoof your domain. Those two cases need very different responses. How do I read DMARC reports?
5. The reveal
Dee pulls the mask off the suspect, and it is not Imma. It is Otto, Sally's own helpdesk auto-reply, sending in her name and signing with the helpdesk's domain instead of hers. No villain. A forgotten tool.
The picture: The mask comes off. Imma was never there. Otto waves his stiff wave, SALLY on his name tag, no badge underneath.
From the Almanac
- 003.003.022 Common causes of DMARC failures include an ESP configured to sign with its own domain, not yours, and a sending service you forgot to authorize. What happens when DMARC fails?
- 003.003.019 Most sources in a report will be your ESP, your transactional provider, maybe your helpdesk or CRM. How do I read DMARC reports?
6. The badge
Dee asks the helpdesk vendor for its DKIM record, adds it to Sally's DNS, and Otto's mail is now signed with Sally's own domain. The name on the tag matches the name on the badge.
The picture: Dee pins a badge on Otto. At the door, Phil holds the badge next to the name tag, they match, and he stamps it through.
From the Almanac
- 003.003.027 Vendors give you a CNAME record for your DNS. Their key server then signs mail with your domain, so the signing domain matches your From domain and alignment happens. How do third-party senders authenticate under DMARC?
- 003.003.012 Alignment requires the domain authenticated by SPF or DKIM to match the domain in the visible From header. Only one needs to align for DMARC to pass. What is DMARC alignment?
7. Closing the door
With every real sender badged, Sally turns the dial in stages: from watching, to the spam folder, to blocking. Then a real faker finally tries the door, and bounces.
The picture: A dial by the door moves none, quarantine, reject. Imma, for real this time, walks up in Sally's outfit and Phil turns her away before she reaches a single inbox.
From the Almanac
- 003.003.018 Move in stages and watch the reports at each step. Jumping straight from none to reject is how organizations accidentally block their own password reset emails. How do you move from none → reject safely?
- 023.002.006 A spoofer cannot produce a valid DKIM signature with your key or send from an SPF-authorized IP, so forged mail fails alignment and is blocked. A p=none policy only monitors and does not stop spoofing. How can DMARC prevent domain spoofing?
Next time: Sa1ly
Imma registers a lookalike domain, one letter off, and sends from it. Every check passes, because the domain really is hers. DMARC cannot help here.
From the Almanac
- 023.002.011 Because the attacker owns the lookalike, SPF, DKIM and DMARC all pass legitimately. Defenses are domain monitoring and user training, not DMARC. What is a spoofing attack using lookalike domains?
The cast
Six characters, each with a job in the story. Build or tweak any of them in the character editor.
Sally Send The one it happens to
Wants: Her newsletter to reach the people who asked for it. Fears: That someone out there is sending email as her.
Arc: Starts sure she has been hacked. Ends in charge of every sender that uses her name.
Signature moves
- Hits send with total confidence (the SEND button, still to draw)
- Freezes when Marina shows her an email she never wrote
- Points at the suspect across the room
- Reads the report with Dee, finger on the one line she cannot explain
- Turns the policy dial from watch, to spam folder, to block
Colour: Brand teal jacket over a teal striped top. The sender always wears teal.
Dee Livery The detective, and her buddy
Wants: To find out who is really sending, before anyone blames the wrong person. Fears: None. Dee has seen this a hundred times.
Arc: Says the line that starts it all, sets up the watch, and solves the case.
Signature moves
- "Hey buddy, your email's not authenticated, so no one knows it's actually you."
- Sets up the watch (a lantern at the door)
- Reads the report under the magnifier
- Hands Otto his badge
Colour: Coral check shirt and denim. Warm, practical, easy to spot in any scene.
Phil Terr The gatekeeper at the inbox door
Wants: To let real senders in and keep fakes out. Fears: Two envelopes with the same name and no way to tell which is real.
Arc: Cannot tell Sally from a fake at first. Once she is badged, he knows her on sight and turns the fake away.
Signature moves
- Checks the badge on every envelope
- Shrugs at two identical envelopes
- Stamps a matching badge
- Holds up a hand to the fake
Colour: Navy and periwinkle, like a uniform. Fair, official, never a villain.
Marina Tidewell The witness, a loyal subscriber
Wants: Sally's emails, and only Sally's. Fears: Being tricked by an email that only looks like Sally.
Arc: Brings the first clue: an email from Sally that Sally never wrote.
Signature moves
- Holds up the strange envelope
- Compares two envelopes side by side
- Smiles when Sally's mail arrives badged
Colour: Mint with white dots and keep-green shoes. A keeper wears keep green.
Imma Poster The suspect (new name, needs your yes)
Wants: To be mistaken for Sally. Fears: A door that checks badges.
Arc: The red herring. Blamed for everything, guilty of nothing, until the finale, when a real faker tries the door and bounces.
Signature moves
- Wears Sally's exact outfit
- Lurks at the edge of the frame
- Gets unmasked, and it is not her
- Bounces off the closed door
Colour: Sally's outfit copied, given away by red shoes and sunglasses.
Otto Responder The real answer: a forgotten tool
Wants: To answer every customer, instantly, in Sally's name. Fears: Nothing. Otto is a helpdesk auto-reply and does not know he is a suspect.
Arc: Sends as Sally without her badge. Unmasked, badged, and back to work.
Signature moves
- Replies to everyone with the same stiff wave
- Wears a SALLY name tag with no badge
- Gets his badge from Dee
Colour: Stone with a sky pinstripe. A plain office look, because he is just a tool.
Gaps for you
Where the story needs something the Almanac does not say. Nothing here was filled in.
- The seed line "no one knows it's actually you" is Dee's dialogue, not a fact. The Almanac backs the idea (the protocols never required sender verification, 023.002.001) but has no line that says unauthenticated mail is treated as anonymous. Keep it as dialogue, or ask for an Almanac line?
- Episode 2 has Marina receive an email Sally never wrote. The Almanac does not say how a subscriber would notice. The story shows it, it does not claim it.
- Episode 5 makes the forgotten sender a helpdesk auto-reply. The Almanac names helpdesks among usual sources (003.003.019) and forgotten services as a cause of failure (003.003.022), but no answer tells a helpdesk story. It is our example, not an Almanac case.
Waiting for their own story
Characters from the earlier cast who are not in this case. Each gets a story of its own later. These are ideas, not facts, and each will be checked against the Almanac when it is written.
Kai Driftwood
The one who went quiet. A list story: the subscriber who drifts away, and when to stop sending.
Una Subscribe
The one who left. A consent story: leaving is easy, and complaining is what happens when it is not.
Skipper Mako
The outreach sender. An outreach story: sending to strangers well, or badly.
Your choices
- The story: yes, or what to change.
- Each character: yes, or build the change in the editor and paste the code.
- The three gaps: keep as story, or ask for Almanac lines.
- New names: Imma Poster (the suspect). Otto Responder is already in the demo-names library.
Characters drawn with Open Peeps by Pablo Stanley, CC0. Colours outside the brand are a proposal (wardrobe palette, 2026-09-29).