Topic starter
23/06/2026 7:24 pm
TL;DR: Email remains outside most Zero Trust models unless DMARC, SPF, and DKIM are enforced alongside PKI and TLS, because the “From” field is otherwise still trusted by default, according to DigiCert. The real failure is an implicit trust assumption that lets phishing and impersonation bypass identity verification before delivery.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “Zero Trust email: How DMARC works with PKI and TLS”.
Key questions
Q: How should organisations implement DMARC without breaking legitimate mail flow?
A: Start by inventorying every system that sends email for the organisation, then publish SPF and DKIM for each legitimate source.
Q: Why do attackers still exploit email when web traffic is already protected by PKI and TLS?
A: Because email often still accepts identity claims without equivalent verification.
Q: What are the signs that email authentication controls are not working well enough?
A: Warning signs include users still receiving convincing spoofed emails, phishing attempts reaching inboxes, and recipients having no easy way to verify sender authenticity.
Practitioner guidance
- Audit all sending domains Inventory every domain and subdomain that sends email, including parked, legacy, and third-party service domains, then map each one to SPF, DKIM, and DMARC ownership.
- Move DMARC from visibility to enforcement Review aggregate reports, remove unauthorised senders, then step policy from none to quarantine and reject once legitimate mail paths are covered.
- Align email controls with web trust posture Compare the assurance model for inbound email with the organisation’s external web identity controls, then close gaps where one channel still relies on implicit trust.
Bottom line: Email remains a Zero Trust exception when the visible sender identity is accepted without domain-level verification.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:23 am
Implicit trust in the From field is the core Zero Trust failure in email. The channel still accepts self-asserted identity claims unless DMARC-style enforcement intervenes. That is a governance gap, not just a mail hygiene issue, because it leaves identity verification optional at the exact moment trust is being assigned. Practitioners should treat email as part of the identity control plane, not as a separate communications problem.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- 48% of organisations cite cloud-based services as a driver for PKI deployment, according to the 2023 State of Machine Identity Management report.
A question worth separating out:
Q: What should security teams do when a business unit wants a new email sending service?
A: Require the service to be registered in sender inventory before any mail goes live, then validate SPF, DKIM, and DMARC alignment as part of onboarding. If the service cannot prove domain authority cleanly, it should not be allowed to send on behalf of the organisation until the trust chain is documented.
👉 Read our full editorial: Zero Trust email needs DMARC, PKI and TLS together