Why do so many sysadmins forget about DKIM/DMARC/SPF when setting up third party services?

Like on a practical level or on a fundamental level ? Certificate 101 is basically: - You have a public/private keypair: the public key is a lock, the private key is a key. Anyone can use your lock to send data, but only you can open the lock to read the data. If you and a friend exchange public keys, you have bidirectional secure communication. - The issue is that you still have to exchange keys, and how do you make sure that you're handing the key to your recipient and not to a man in the middle attacker ? You bring a common, trusted friend that tells you "yep, that's him". That friend is the certificate authority (CA). - In practice, the CA doesn't actually oversee the key exchange, but instead, anyone with a public key can ask the CA to certify it. The CA then issues a signed certificate which says "This key is Mr. Recipient's". - When you receive a signed certificate, you then verify that the signature on the note matches the CA's one that you have on file (in your "trusted CA store"). - You can have certificates that aren't directly signed by a CA, but by another certificate which is itself signed by a CA. As long as you can go up the chain until you hit a CA that is in your trusted CA store, you have established a "chain of trust" and everything in that chain is trusted. You can also have certificates that are not signed by a CA but self-signed. This is a "I'm who I pretend to be, trust me bro" certificate : at the top of every chain of trust is one such cert. For public-facing certs it's usually a private company's that OS and browser manufacturers trust like Verysign or Let's Encrypt, in enterprise settings, it's the one Bob the IT manager has issued and has put into everyone's trusted stores using group policy (or hasn't, so you have to click "I understand the risks, proceed" every time). A "certificate" in the colloquial sense is the key + information about the owner + attestation of authenticity from the CA. A term you'll often find is "CSR" or "certificate request", which is just key + owner info that you send to your CA so that it can sign it and give you your certificate. Finally there are certificate revocation lists: they are just lists emitted by the CAs themselves telling the world "yo someone managed to copy my handwriting (aka stole the private keys we used for signatures), do not trust it anymore".