Email Security & Anti-Phishing (DMARC)

These three work together. SPF lists which servers are allowed to send for your domain. DKIM signs each message so the receiver can verify it was not tampered with and really came from you. DMARC ties the two to the visible From address through alignment, and tells receiving servers what to do when a message fails. Miss the alignment and an attacker can still forge the address your users actually see, even with SPF and DKIM technically passing.

A DMARC record with p=none monitors but blocks nothing. It is a starting point, not protection. The protection comes from moving to p=quarantine and then p=reject, at which point receiving servers actively bin mail that fails your checks. The whole risk is doing that without accidentally blocking your own newsletters, your CRM or your finance system, which is why the move has to be evidence-led.

Companies send mail from more places than they think: the mail platform, the CRM, the helpdesk, the marketing tool, the accounting system, the odd server someone set up years ago. We deploy DMARC in monitoring mode and read the aggregate reports to build a complete picture of who is sending as you, legitimate and not.

For each legitimate service we set up proper SPF entries and DKIM signing so it authenticates and aligns. This is the unglamorous work that makes enforcement safe. Skip it and moving to reject silently drops mail your business depends on.

We step the policy up deliberately, often using the DMARC percentage tag to enforce on a slice of traffic first, watching the reports at each stage. By the time you reach p=reject, we have evidence that no legitimate mail is caught, and forged mail from your domain is being rejected outright.

What enforcement actually buys you

Once you are at p=reject, an attacker can no longer send mail that appears to come from your exact domain to any receiver that honours DMARC, which is essentially all the major providers. That closes off the most convincing phishing, the fake invoice that appears to come from your CEO, and the supplier-impersonation fraud that hits your customers. It also protects your deliverability and your brand.

Attackers register domains that read like yours at a glance, then send convincing mail from them. We help you monitor for these registrations and configure inbound rules and warnings so a message from a near-miss domain is flagged before someone acts on it.

The costliest email attacks are not malware. They are a well-written message asking finance to change bank details or pay an urgent invoice, sent from a spoofed or compromised account. We tune inbound impersonation detection, add banners for external and first-time senders, and pair the technical controls with the awareness training that stops the click. The technology and the human have to both hold.

By default, mail servers will fall back to unencrypted delivery if TLS negotiation is downgraded, which opens the door to interception. MTA-STS tells sending servers to require TLS for your domain, and TLS-RPT reports any failures so you can see attempted downgrades. Together they close a quiet gap that most domains leave open.

Once you are enforcing DMARC, BIMI lets your verified brand logo appear next to your messages in supporting inboxes. It is a reward for doing the authentication properly: better recognition, higher engagement, and one more signal to your recipients that the mail is genuinely from you.

Major mailbox providers now require SPF, DKIM and DMARC for bulk senders, and failing to authenticate hurts your deliverability directly. ISO 27001 control A.8.23 covers web and messaging protections, and email fraud sits squarely in the risk assessments behind SOC 2, GDPR and DORA. We document the setup so it satisfies both the technical bar and the audit question.

GDPR expects appropriate technical measures for personal data, and unencrypted email is a weak point. Enforcing TLS through MTA-STS is a concrete, demonstrable control you can point to.

In the phishing simulations we run for clients, the messages that get the most clicks are the ones that appear to come from a trusted internal or supplier address. Enforcing DMARC removes the most convincing version of that attack outright. Because we have sat on the attacker’s side, we prioritise the controls that actually change an attacker’s odds, not the ones that just look tidy on a scan report.

Aggregate reports arrive as XML from dozens of receivers every day. A tool can chart them; it takes judgement to tell a newly onboarded marketing platform apart from a spoofing campaign warming up against your brand. We watch for the patterns that matter and tell you when something needs action, rather than leaving you a dashboard to interpret alone.

Email estates drift. A new SaaS tool starts sending on your behalf, a record gets edited, a policy quietly slips. Ongoing monitoring catches the drift before it either breaks your mail or reopens the spoofing gap, so the protection you paid to set up is still real a year later.