SPF, DKIM & DMARC: Stopping Domain Spoofing and Executive Impersonation
Why traditional spam filters fail against spoofed domains, and how enforcing DMARC p=reject stops attackers from impersonating your executive team and company brand.
Why Email Authentication Is Frequently Misunderstood
Email was engineered in the early days of ARPANET without built-in identity verification. By default, any mail server on the internet can transmit an email with your organization's exact domain in the 'From:' header. Without cryptographic authentication standards, receiving mail servers will accept and deliver the fraudulent message directly to the recipient's primary inbox.
For organizations in commercial hubs like Colombo and Dubai that transact high-value contracts and vendor invoices via email, domain spoofing is the primary vehicle for Business Email Compromise (BEC) wire fraud.
Understanding the Defensive Triad
Sender Policy Framework (SPF) is a DNS TXT record that publishes an authorized list of IP addresses allowed to send mail. While essential, SPF alone only validates the hidden return-path.
DomainKeys Identified Mail (DKIM) adds a cryptographic signature to outbound headers, verified by public keys in DNS.
Domain-based Message Authentication (DMARC) bridges SPF and DKIM by enforcing identifier alignment with the visible From header.
The Three DMARC Policy Modes
`p=none` (Monitoring mode): Deliver the email anyway and send telemetry reports.
`p=quarantine` (Suspicious mode): Direct failed messages into Spam/Junk.
`p=reject` (Full defensive enforcement): Instruct mail systems worldwide to outright drop unauthorized emails claiming to originate from your domain.
The Path to Enforcement
Organizations must never jump directly to p=reject without an initial monitoring period. Legitimate third-party services—such as CRM systems, marketing automation, accounting software, and HR portals—frequently send email using your domain. A disciplined phased audit ensures legitimate workflows are authenticated before enforcing strict rejection.
Related Articles & Advisories
The Road to DMARC Enforcement: Migrating from p=none to p=reject Safely
A phased methodology for cataloging third-party senders, aligning cryptographic keys, and enforcing zero-tolerance rejection without dropping legitimate mail.
Business Email Compromise (BEC): Anatomy of Invoice Redirection Wire Fraud
How cybercriminals intercept supplier email threads, manipulate banking details, and siphon millions through synthetic invoice redirection.
Combating QR Code Phishing (Quishing): Why Modern Mail Filters Get Blinded
Explaining the explosion of QR code lures in corporate inboxes and the optical character recognition (OCR) defenses needed to inspect embedded URLs.