The Challenge
A phishing campaign targets parents at a local high school. Bad actors send SMS messages and emails spoofing the school’s branding, claiming an active emergency and demanding a “transportation fee” to safely bus students to a reunification site.
The School Contact Solution
Under School Contact, the attack fails structurally rather than depending on parents noticing something is wrong. Every domain the district uses carries the mandatory email-authentication baseline — DNSSEC, SPF, DKIM, and enforced DMARC — so a spoofed message impersonating the district’s domain simply doesn’t deliver as genuine mail. The district pushes an authenticated, one-way broadcast confirming the earlier messages were fraudulent.
Because parents communicate using their retired-never-recycled guardian alias, the school’s system can check any inbound reply against the relationship layer — confirming both that the alias is active and that the sender currently holds guardianship rights for a specific enrolled student — before treating it as trusted. And because the verified channel was never publicly browsable, it was never a target the attackers could spoof in the first place.
Demonstrates the domain security baseline, the retire-never-recycle guardian alias policy, and query-response verification working together against a real attack pattern.