Topic starter
24/06/2026 10:48 pm
TL;DR: Email impersonation continues to drive business email compromise and phishing losses because many organisations still verify message content more often than sender authority, according to DigiCert and the FBI. Treating sender identity as a deterministic control closes a core digital trust gap that content filters alone cannot solve.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “What Sender Identity Means for Digital Trust”.
By the numbers:
- Business email compromise attacks accounted for over $2.7 billion in reported losses in 2024.
Key questions
Q: Why do phishing campaigns still work even when organisations have security tools in place?
A: They often succeed before tooling has a chance to intervene.
Q: When should organisations tighten DMARC enforcement instead of staying in monitor mode?
A: Once SPF and DKIM are stable and the authorised sending estate is understood.
Q: What breaks when sender identity is not verified at the domain level?
A: The organisation loses a reliable boundary for deciding whether an email truly came from an authorised source.
Practitioner guidance
- Audit all sending domains Inventory primary, parked and legacy domains, then identify every service that can send mail on behalf of the organisation.
- Implement SPF and DKIM for every sender Configure authorised sending sources for each domain and align cryptographic signing so receiving systems can verify both the server and the message integrity.
- Move DMARC to enforcement Use p=none only to gather data, then shift legitimate domains to quarantine and reject once authorised senders are fully known and aligned.
Bottom line: Email impersonation persists because many organisations still verify message appearance more often than sender authority.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:38 am
Sender identity is an email governance problem, not only a security filter problem: Organisations have spent heavily on content inspection, but that does not answer the identity question behind a message. The missing control is proof that the sender was authorised to use the domain. In practice, email trust fails when verification is treated as optional metadata instead of a policy boundary.
A question worth separating out:
Q: What is the difference between DMARC enforcement and a secure email gateway?
A: DMARC enforcement answers whether the sender is authorised to use the domain, while a secure email gateway decides whether the message content looks malicious. They solve different problems and should work together. DMARC stops impersonation at the source, and the gateway catches threats that still arrive through legitimate channels.
👉 Read our full editorial: Sender identity verification is the missing layer in email trust