Why Email Security Matters

Email is still one of the most common ways into an organization, and your domain name is part of what attackers can abuse. Knowing the threats helps you decide what to fix first.

The Threat Landscape

Email Spoofing

What it is: Attackers send email that appears to come from your domain.

Impact:

• Phishing aimed at your customers, partners and staff
• Damage to your brand's reputation
• Legitimate mail from your domain landing in spam

Prevention: SPF, DKIM and DMARC at p=quarantine or p=reject.

Business Email Compromise (BEC)

What it is: Attackers impersonate executives, suppliers or partners to get employees to transfer money or share sensitive data.

Scale: BEC is one of the costliest types of cybercrime. The FBI's Internet Crime Complaint Center (IC3) counted about $2.7 billion in reported BEC losses in 2022 alone (2022 Internet Crime Report).

Prevention: DMARC enforcement stops attackers from using your exact domain. Lookalike domains and compromised accounts need other controls, such as payment verification procedures and staff training.

Phishing

What it is: Fraudulent email designed to steal credentials, install malware or extract information.

Impact:

• Stolen credentials lead to account takeover
• Malware delivered through attachments and links

Prevention: Email authentication blocks phishing that spoofs your own domain.

Interception in Transit

What it is: An attacker between mail servers downgrades or intercepts the connection, reading or changing messages.

Impact:

• Exposure of confidential information
• Changed payment details on invoices

Prevention: MTA-STS or DANE make senders require a verified TLS connection to your mail servers.

Business Impact

• Direct fraud losses from BEC and invoice fraud
• Incident response time and cost
• Reputation damage when customers are phished in your name
• Deliverability problems when your domain's reputation suffers

Requirements From Mailbox Providers and Regulators

Mailbox Providers

Large mailbox providers now require authentication from bulk senders:

• Google and Yahoo (since February 2024): senders of large volumes to Gmail and Yahoo addresses need SPF, DKIM and a DMARC record, with aligned authentication.
• Microsoft (since May 2025): high-volume senders to Outlook.com addresses need SPF, DKIM and DMARC.

Standards and Regulations

• PCI DSS v4.0 requires processes and automated mechanisms to protect staff against phishing (requirement 5.4.1), and names DMARC, SPF and DKIM as examples.
• US federal agencies must use DMARC at p=reject under DHS Binding Operational Directive 18-01.
• UK: the NCSC recommends DMARC for all organizations.
• HIPAA and GDPR require appropriate security for personal and health data, which includes email.

The Cost of Inaction

Without SPF

• Receivers can't tell which servers may send for your domain
• Spoofed mail is harder for receivers to filter

Without DKIM

• Messages can be changed without detection
• Forwarded mail often fails authentication, because SPF breaks on forwarding

Without DMARC

• Receivers get no instructions for mail that fails authentication
• You have no visibility into who sends mail as your domain

Benefits of Implementation

• Stop spoofing of your exact domain once DMARC is enforced
• See every service that sends as your domain, through DMARC reports
• Meet mailbox provider requirements for bulk senders
• Use BIMI to show your logo in supporting mail clients

Getting Started

Assessment

1. Add your domain to MailShield
2. Review its security score
3. See what to fix first

Quick Wins

1. Add an SPF record if missing
2. Publish DMARC with p=none and a reporting address
3. Add TLS-RPT for visibility into transport security

Full Implementation

1. Move DMARC to enforcement (roadmap)
2. Configure MTA-STS
3. Enable DNSSEC
4. Consider BIMI for brand visibility

Get started with MailShield →