Email authentication: what teams miss about outbound impersonation

TL;DR: Email security spans inbound filtering, encryption, authentication, and training, but the decisive gap is outbound sender validation, because SPF, DKIM, and DMARC are what stop exact-domain impersonation and reveal who is sending as your brand, according to Valimail research. In practice, mail security fails when organisations treat inbox filtering as sufficient and ignore the domain layer.

Editorial analysis by NHI Mgmt Group, based on content published by Valimail: “What is email security? Threats, layers, and protocols”.

By the numbers:

• Valimail's 2026 State of DMARC Report shows that 78% of domains have a DMARC record, but only 42% reached enforcement.

Key questions

Q: What breaks when organisations rely on inbox filtering alone to stop phishing?

A: Inbox filtering alone fails when attacks arrive through QR codes, text messages, voice calls, social platforms, or compromised trusted accounts.

Q: Why does DMARC enforcement matter more than just publishing a record?

A: A DMARC record in monitoring mode only reports on alignment failures.

Q: What are the signs that an email domain is poorly governed?

A: Common signals include multiple legitimate services sending as the domain with no central inventory, DMARC left in monitor-only mode, inconsistent SPF and DKIM ownership, and customer or employee reports of lookalike mail.

Practitioner guidance

• Implement DMARC enforcement Move beyond record publication and drive the policy to quarantine or reject after validating all legitimate sending sources and exceptions.
• Inventory every domain sender Build a complete register of marketing tools, CRMs, billing systems, HR platforms, ticketing tools, and any other service that sends as your domain.
• Deploy phishing-resistant MFA for user accounts Use FIDO2 keys or passkeys for high-risk users so credential theft does not turn email compromise into account takeover.

Bottom line: Email security fails when organisations stop at inbox filtering and never govern who is allowed to speak for the domain.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →