Every business has a spam filter. Most have some form of email security gateway. But email security involves far more than blocking the obvious junk, and the gaps between what organisations think they’ve covered and what they’ve actually covered are consistently wider than expected.
Email remains the primary attack vector for initial compromise. Phishing, business email compromise, and malware delivery all rely on email as the delivery mechanism. Defending against these threats requires layers of controls working together, not a single product handling everything.
DMARC, DKIM, and SPF: The Basics Still Matter
These three protocols work together to prevent email spoofing. SPF defines which servers can send email on behalf of your domain. DKIM adds a cryptographic signature to verify the message hasn’t been tampered with. DMARC ties them together and tells receiving servers what to do when authentication fails.
William Fieldhouse, Director of Aardwolf Security Ltd, comments: “DMARC enforcement at the reject level is something we check during every external assessment, and the majority of organisations still don’t have it configured correctly. Without it, anyone can send emails that appear to come from your domain, and your customers and partners have no way to distinguish them from legitimate messages.”
Setting up SPF and DKIM is relatively straightforward. The challenge is getting DMARC to enforcement mode. Many organisations deploy DMARC in monitor-only mode, collect the reports, and never progress to quarantine or reject policies. Monitor mode provides visibility but no protection.
Business Email Compromise Prevention
Business email compromise attacks don’t use malware or malicious links. They rely on impersonation and social engineering. An attacker compromises or spoofs an executive’s email account and sends instructions to the finance team to transfer funds to a new account.
Defending against BEC requires a combination of technical controls and process controls. Implement impersonation detection rules in your email gateway. Require out-of-band verification for payment changes. And train your finance team to verify unusual requests through a channel other than email.
Testing Your Email Security
During external network penetration testing, testers evaluate your email security from the outside. Can they spoof your domain? Do phishing emails reach inboxes? Can they deliver malicious attachments past your filtering?
Engaging a best penetration testing company for a comprehensive assessment that includes email security testing reveals whether your controls work against the techniques that real attackers use, not just the test emails your vendor sends during implementation.
Ongoing Email Security Hygiene
Review your DMARC reports regularly. Monitor for new sending services that need to be added to your SPF record. Keep your email gateway rules updated. And disable legacy protocols like POP3 and IMAP that don’t support modern authentication.
Email security is never finished. The threats evolve constantly, and your controls need to evolve with them. Regular testing and continuous monitoring ensure that your email defences keep pace with the attackers targeting them.
