What do marketing teams get wrong about email authentication?

Why marketing ownership breaks email authentication

email authentication fails in practice when the people changing sending tools are not the same people maintaining the DNS and policy controls behind SPF, DKIM, and DMARC. The technical records can be correct and still become obsolete as soon as a new platform, agency, CRM, or transactional sender is introduced without updating the authorised sender inventory.

That is why this is not just a DNS task. It is an ownership problem that spans campaign operations, domain governance, and the teams that can actually change the sending path. Marketing usually has the best view of what is live, but unless that view is translated into policy, authentication breaks quietly and deliverability, brand protection, and fraud resistance all weaken together.

For teams that want the broader control story, the operational patterns behind email impersonation and sender governance are covered in Email Identity and BEC Guide.

What usually goes wrong when new senders are added

The most common mistake is treating each sending tool as a one-off integration. A platform gets connected, messages start flowing, and the team assumes authentication has been “done” because the initial setup passed testing. Later, another tool is added, a vendor changes how mail is relayed, or a subdomain is introduced for a campaign, and the original SPF, DKIM, or DMARC assumptions no longer match reality.

Another failure mode is partial ownership. IT may manage DNS, security may own the policy language, and marketing may own the actual tools and templates. If no one has explicit responsibility for reconciling those three views, the organisation ends up with stale authorised sender records, unused senders still present in policy, and new senders that are active but invisible to the controls.

That split is also why mailbox compromise and impersonation are not the only concern. Email authentication is a governance control that depends on accurate inventory, clear approval paths, and disciplined change handling, which is why the Workforce Identity Security Guide is useful for understanding the ownership and lifecycle side of the problem.

When organisations need to see how token, account, and sender control failures combine in real incidents, the Twilio 0ktapus breach 2022 shows how weak identity controls and abused trust can cascade beyond one system.

What good email authentication governance looks like

Strong practice starts with a living authorised sender inventory that is owned jointly by marketing operations and security, with DNS changes controlled by the team that can enforce them. Every sender, vendor, subdomain, and relay path should be mapped to a business owner, a technical owner, and an approval step before it can send at scale.

DMARC should then be treated as a policy enforcement mechanism, not a reporting checkbox. If the organisation cannot explain why each sender exists, who approved it, and whether it is still needed, then alignment problems are likely to surface later as delivery failures, spoofing exposure, or exception handling that never gets reversed.

Practitioners comparing authentication options and recovery paths should also review Passwordless and Passkeys Guide, because the same governance discipline that prevents weak sign-in also prevents ad hoc sender sprawl.

Risk and Threat Considerations

When email authentication is owned as a technical setup rather than a governed control, attackers and accidental misconfiguration benefit from the same gap. A forgotten sender, delegated agency platform, or unmanaged subdomain can create a trusted path for spoofing, message rejection, or unauthorised mail that looks legitimate enough to bypass user suspicion.

Failure mechanism: The organisation loses sync between what is allowed in policy and what is actually sending, so authentication records no longer reflect the live attack surface. That mismatch can be exploited for impersonation, or it can simply break legitimate mail and hide the underlying control failure until delivery problems or fraud appear.

Impact: The result is weaker brand trust, reduced deliverability, and a larger window for phishing or invoice fraud that uses your own domain as cover. In mature environments, the bigger risk is not a single bad record, it is control drift across multiple teams and tools.

Practitioner Guidance

What to verify: Confirm that every sending platform, subdomain, and third-party mailer has a named owner and is reflected in the current authorised sender list before approving any new campaign or tool.

Decision rule: If the marketing team can add or change a sender without the DNS or policy owner being informed, the control design is already failing and should be treated as a governance issue, not a tuning issue.

Common mistake: Do not accept “SPF, DKIM, and DMARC are configured” as sufficient evidence. The real test is whether the configuration still matches the active sender inventory after the last tool, vendor, or domain change.

Practitioner takeaway: Email authentication only works when sender governance is operationally current, because the records are defensive only if they track the real sending estate.

Related resources from NHI Mgmt Group

• What do security teams get wrong about legacy authentication in email?
• What do teams get wrong about unified identity when they combine social login and email-based authentication?
• What do security teams get wrong about DNS email authentication?
• What do security teams get wrong about passwordless authentication and AI risk?