Topic starter
23/10/2026 12:47 am
TL;DR: Outbound sender validation is the gap that matters most for brand impersonation, because SPF, DKIM, and DMARC are what stop exact-domain spoofing, according to Valimail. Email governance has to move past inbox filtering if organisations want to know who is allowed to speak for a domain.
Editorial analysis by NHI Mgmt Group, based on content published by Valimail: “What is email security? Threats, layers, and protocols”.
By the numbers:
- Valimail's 2026 State of DMARC Report shows that 78% of domains have a DMARC record, but only 42% reached enforcement.
Key questions
Q: Why does DMARC enforcement matter more than just publishing a record?
A: A DMARC record in monitoring mode only reports on alignment failures.
Q: What are the signs that an email domain is poorly governed?
A: Common signals include multiple legitimate services sending as the domain with no central inventory, DMARC left in monitor-only mode, inconsistent SPF and DKIM ownership, and customer or employee reports of lookalike mail.
Q: What breaks when organisations rely on inbox filtering alone to stop phishing?
A: Inbox filtering alone fails when attacks arrive through QR codes, text messages, voice calls, social platforms, or compromised trusted accounts.
Practitioner guidance
- Implement DMARC enforcement Move beyond record publication and drive the policy to quarantine or reject after validating all legitimate sending sources and exceptions.
- Inventory every domain sender Build a complete register of marketing tools, CRMs, billing systems, HR platforms, ticketing tools, and any other service that sends as your domain.
- Deploy phishing-resistant MFA for user accounts Use FIDO2 keys or passkeys for high-risk users so credential theft does not turn email compromise into account takeover.
Bottom line: Email security fails when organisations stop at inbox filtering and never govern who is allowed to speak for the domain.
Glossary terms: Sender Authentication, DMARC, Lookalike Domain, Outbound Email Security
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
Outbound sender authentication is the real identity control in email. Organisations often treat email security as a content problem, but spoofing succeeds when the sender identity layer is weak. SPF, DKIM, and DMARC are not add-ons to inbox filtering, they are the mechanism that tells recipients whether a domain is allowed to speak. For identity programmes, the lesson is simple: if the domain can be impersonated, the channel can be weaponised.
A few things that frame the scale:
- Impersonation fraud accounted for over 85% of all fraud attacks in 2025.
A question worth separating out:
Q: Should organisations prioritise sender authentication before adding more inbox tools?
A: Yes, when the main risk is impersonation or brand abuse. Inbox tools help with malicious content, but sender authentication addresses whether the message should be trusted in the first place. If the domain is not governed, adding more filtering only improves the downstream detection layer.
👉 Read our full editorial: Email authentication is the missing control for brand impersonation
This post was modified 6 days ago by NHI Mgmt Group