Why do organisations stay exposed after SPF and DKIM are in place?

Why SPF and DKIM do not finish the job

SPF and DKIM are message authentication signals, not a complete anti-spoofing policy. They tell receiving systems whether a message lines up with an authorised sender path and whether the content was signed, but they do not instruct receivers what to do when those checks fail. That decision only becomes enforceable when DMARC is moved from monitoring to enforcement.

That gap matters because spoofing resistance depends on the full chain, not just two technical checks. Organisations often believe they are “done” once SPF and DKIM pass, then leave the domain open to lookalike or unauthorised mail that still reaches inboxes because receiving systems are not told to reject or quarantine it.

SPF also depends on accurate sender inventory. If legitimate platforms, marketing systems, ticketing tools, or outsourced mail services are omitted, teams weaken the record to keep mail flowing. That creates a false sense of coverage and leaves room for both bypass and operational drift.

Where the exposure usually comes from

The most common failure is fragmented mail flow ownership. Marketing, HR, finance, product, and IT may each add a sender without a single inventory or control owner, so the published policy never fully reflects the real mail estate. Third-party services can also break alignment when they send on behalf of the domain in ways the governance team does not regularly review.

Another issue is that SPF and DKIM are often treated as one-time configuration tasks instead of living controls. Once the records are published, teams stop validating whether new vendors, new subdomains, forwarding paths, or changes in mail routing have altered the effective protection. A domain can look “secured” while still accepting unauthenticated or misaligned mail.

For a deeper implementation view, DMARC, SPF and DKIM Guide shows why alignment, rollout sequencing, and report review matter as much as the records themselves. For broader email architecture, the Email Security Guide is useful when SPF and DKIM are only one part of the delivery path.

Governance becomes the hidden weak point when the organisation has the right records but no clear process for change approval, vendor onboarding, or periodic review. In that state, email authentication is technically present but operationally brittle, which is why exposure persists long after the initial setup project is complete.

What enforcement changes in practice

Moving DMARC to enforcement changes the receiver’s behaviour from passive observation to policy action. That is the step that turns authentication signals into a usable control against spoofing, because it gives mail providers a consistent instruction for handling messages that fail alignment.

Enforcement works best when it is paired with a complete sender inventory, verified third-party dependencies, and continuous report review. Without those inputs, an organisation can still see failures, but it will not know whether the failures are malicious, expected, or the result of a legitimate system that was never added to the policy.

Authoritative guidance from the DMARC, SPF and DKIM Guide aligns with the staged approach most defenders use: observe, validate, then move toward rejection once legitimate traffic is understood. That sequencing reduces the chance that enforcement breaks real mail while still closing the spoofing gap.

Risk and Threat Considerations

Mail authentication gaps are attractive because they let an attacker impersonate a trusted domain without needing to compromise the real mailbox. If DMARC is not enforced, the defender may have good-looking records and still accept spoofed messages that are designed to trigger payment diversion, credential theft, or business email compromise.

Failure mechanism: A permissive or incomplete mail-authentication policy allows unauthorised messages to survive delivery checks, especially when third-party senders, forwarding paths, or alignment mistakes create exceptions that are not continuously governed.

Impact: The organisation can suffer impersonation, fraud, and trust erosion even though SPF and DKIM appear to be in place, because the receiver is still allowed to accept mail that should have been rejected or quarantined.

Practitioner Guidance

What to verify: Confirm that every legitimate sender, including outsourced and application-driven mail, is represented in the approved inventory before you move from monitoring to enforcement. If a sender is missing, fix the inventory and alignment first, not after inbox disruption appears.

Decision rule: If the organisation cannot explain why a message source is authorised, treat it as a governance problem, not just a mail-routing issue. If the mail path is legitimate but fragile, stabilise the dependency and then tighten policy; do not leave enforcement deferred indefinitely because one external platform is awkward to map.

Practitioner takeaway: SPF and DKIM reduce impersonation risk, but only DMARC enforcement plus continuous sender governance closes the operational gap that spoofers exploit.

Related resources from NHI Mgmt Group

• How do organisations reduce the dwell time of exposed credentials at scale?
• How do organisations operationalise NHI ownership at scale?
• When should organisations treat an NHI as a high-priority risk?
• How can organisations reduce the blast radius of compromised agent identities?