The four surfaces — Domain Trust Architecture

A third party determining what is yours does so in four distinct ways, and every control in both tracks defends exactly one of them. Naming the surface an attack targets is what tells you which control could possibly have stopped it.

The surfaces

Surface	The question it answers	Attacked by
Identity	Is this message or this name genuinely from the party it claims?	Spoofing, lookalike domains, display-name deception
Integrity	Is what I am reading what they published?	Cache poisoning, message modification, record tampering
Transport	Did this reach me without being read or altered on the way?	STARTTLS stripping, on-path interception
Perception	Does what a human sees match what the protocols determined?	Homographs, subdomain-shaped URLs, a logo that means nothing

Every control, on one surface

IDENTITY     SPF, DKIM, DMARC, alignment, CAA,
             registrar locks, registry lock

INTEGRITY    DNSSEC, DKIM body hash, zone transfer
             authentication, CT

TRANSPORT    MTA-STS, DANE, TLS-RPT, opportunistic TLS

PERCEPTION   BIMI, IDN display rules, user training,
             external-sender warnings

Two of those placements are worth pausing on. DKIM appears twice because it does two things: the signature asserts identity and the body hash asserts integrity. CT is an integrity control rather than an identity one — it does not say who may issue, it makes every issuance visible.

Perception is the weakest surface

It is the only surface where the defence is a human rather than a check. Every other surface has something that verifies automatically and fails closed; perception has a person glancing at an address bar. That is why the residual after full enforcement is almost entirely perception attacks — and why user-facing controls are not a lesser alternative to technical ones but the only thing that addresses that surface at all.

Use the surfaces to answer “would this have helped?”

After any incident, name the surface. A lookalike domain attacked perception, so DMARC enforcement could not have stopped it and monitoring might have. A supplier compromise attacked nothing — every surface reported truthfully. The question is answered in seconds and it ends a great deal of unproductive discussion.

Knowledge check

A customer is deceived by a homograph domain with valid TLS and a perfect DMARC record of its own. Which surface failed?

Perception — every protocol check passed correctly on a domain the attacker genuinely controls.
Identity, because the domain impersonated the brand.
Integrity, because the content was not authentic.
Transport, because TLS did not prevent the deception.

Correct — Perception — every protocol check passed correctly on a domain the attacker genuinely controls. Identity, integrity and transport all did their jobs: the message really was from that domain, unmodified, over TLS. What failed is the gap between what the protocols determined and what a human saw.

Not this — Identity, because the domain impersonated the brand. Identity controls answer whether a message is from the party it claims. It is — the deception is in how the name reads.

Not this — Integrity, because the content was not authentic. The content is exactly what the sender published. Integrity is unaffected.

Not this — Transport, because TLS did not prevent the deception. TLS worked. It secures the hop and says nothing about who the other end is to a human reader.