Email Security

• Phishing is the most profitable attack; nearly all of it rides email, and spoofed domains are its engine.
• SPF/DKIM/DMARC are DNS records you can ship today without touching a server — cheap, measurable protection.
• Email breaches create regulatory gravity; security teams live or die on their egress posture.

SPF is the uniform list of postmen; DKIM is the signature on each envelope; DMARC says 'reject anything without both'.

• SPF publishes which IPs are allowed to send for your domain, as a TXT record the receiving MTA checks in parallel to the connection.
• DKIM signs each message body+headers with a private key; the public key sits in a DNS TXT record under a selector name.
• DMARC states the policy (none/quarantine/reject) and where to send aggregate/forensic reports, judged on alignment of SPF+DKIM domain.
• Mail servers evaluate the envelope, then DMARC decides enforcement; BIMI/SMIME and domain branding layer on top of these.

• A domain moves DMARC from none to quarantine to reject over a quarter, while monitoring aggregate reports for silent sender loss.
• A marketing ESP is added to SPF pluses and DKIM selectors so mailed campaigns still pass alignment.
• A SOC queries DMARC reports to spot mass spoofing of a rival domain and blocks their campaign faster than mailbox analytics.

• Publish SPF with -all (not ~all) after confirming all legitimate senders, and keep the 10-lookup DNS limit in mind.
• Rotate DKIM selectors by publishing a new key every 90 days and retiring the old one after the mail subtree drains.
• Adopt DMARC 'v=DMARC1; p=quarantine' at minimum; aim for p=reject with a monitoring period.
• Add DMARC alignment checks into every egress gateway and alert on drops.

• Publishing p=reject before ESPs/subdomains are ready, silently bouncing legitimate orders and support mail.
• Treating SPF alone as identity: SPF does not align the visible From: domain, so spoofing still works.
• Forgetting the DNS lookup budget — an SPF record chained over 10 lookups causes 'permerror' and drops.
• Ignoring DMARC aggregate reports: enforcement without visibility is flying blind.

• Query your readiness with nslookup -type=TXT <domain>; then emailb.is and dmarcly.com validate your own domain.
• When a legit sender fails DKIM, list the exact selector from the fail header ('d=...; s=...') and check that TXT record.
• Test-domain spoofing from an alias you control: mail to a scratch address and read the Authentication-Results header.

• Test spoofing/pentests ONLY against domains you own; sending bulk mail to others without consent is abuse and unlawful.
• Store DMARC reports ensure the retention controls your provider honors before enabling p=reject.
• Email controls protect the envelope, not the content: pair with MFA and secure content-sharing for real risk reduction.