Topic starter
14/07/2026 4:26 pm
TL;DR: GenAI now lets attackers generate convincing phishing and BEC messages at speed, while lookalike domains evade SPF, DKIM, and DMARC, according to Proofpoint. The control gap is no longer only message filtering, but source-domain protection, brand monitoring, and takedown discipline.
Editorial analysis by NHI Mgmt Group, based on content published by Proofpoint: “Why strong DMARC policies are critical in the age of AI‑driven impersonation”.
Key questions
Q: What fails when DMARC is enforced but attackers use lookalike domains?
A: DMARC blocks exact-domain spoofing, but it does not stop an attacker who registers a brand-adjacent domain and sends from that domain instead.
A: AI-written phishing increases risk because it lowers the attacker’s effort while raising message quality.
Q: How do security teams know if impersonation detection is actually working?
A: It is working if high-risk requests are consistently challenged, blocked, or escalated when the claimant cannot satisfy stronger proofing controls.
Practitioner guidance
- Enforce DMARC at reject or quarantine Move beyond monitoring-only DMARC and require policy enforcement for authenticated sending domains.
- Monitor lookalike domain registrations Track brand-adjacent registrations, typosquats, homoglyphs and alternative TLDs that could be used for impersonation.
- Build a takedown workflow for malicious sites Pre-arrange registrar and hosting escalation paths so malicious domains can be removed quickly once confirmed.
Bottom line: AI-generated impersonation has pushed email fraud beyond simple spoofing into a broader trust-abuse problem involving brands, domains and sender identity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 5:07 pm
AI-driven impersonation is now an identity governance problem, not just an email problem. The article shows that attackers are using GenAI to industrialise trust abuse across email and web channels, which means the control boundary has moved from filtering messages to governing brand, sender and domain identity. For IAM and fraud teams, this is a signal that the identity perimeter now includes the public domain namespace.
A few things that frame the scale:
- Impersonation fraud accounted for over 85% of all fraud attacks in 2025.
A question worth separating out:
Q: Should organisations treat email authentication and domain protection as the same control?
A: No. Email authentication governs whether a message can claim a trusted domain, while domain protection governs whether an attacker can register and weaponise a similar domain in the first place. Organisations need both, because authentication protects delivery integrity and domain governance protects the trust layer that impersonation exploits.
👉 Read our full editorial: AI-driven impersonation is outpacing email authentication controls