What Is Email Security?

Email remains the dominant initial access vector, and the reason is structural rather than technical. It is the one channel that must accept unsolicited content from strangers in order to function, and that content reaches people whose job is to open and act on it.

Modern email attacks are also increasingly payload-free. Business email compromise carries no attachment and no malicious link — just a plausible instruction from a plausible sender — which defeats filtering designed to detect malicious content.

Authentication is the foundation, and it is incomplete everywhere

SPF, DKIM and DMARC together establish whether a message genuinely came from the domain it claims. SPF declares which servers may send for the domain, DKIM signs messages cryptographically, and DMARC tells receivers what to do when those checks fail.

The crucial detail is that DMARC only protects when it is set to reject. A policy of none monitors and enforces nothing, and a substantial proportion of deployed DMARC records sit at none permanently — producing reports nobody reads while direct domain spoofing continues to work.

Reaching enforcement requires finding every legitimate sender first, including marketing platforms, ticketing systems and applications sending on behalf of the domain. That inventory is the work; the policy change is trivial once it is done.

What authentication does not stop

Lookalike domains, which pass their own authentication perfectly because the attacker owns them. Compromised legitimate accounts at a supplier, where the mail is genuinely from who it claims. And display name spoofing, which most mobile clients present in a way that hides the actual address.

Those require different controls: external sender warnings, lookalike domain monitoring, and — for anything involving payment or access — verification through a separate channel that does not depend on the email being genuine.

Detecting the compromised mailbox

Once an account is taken over, the signals are behavioural rather than content-based. Mailbox rules created to auto-delete or forward messages are the classic indicator, created by an attacker to hide replies from the legitimate owner.

Monitoring for new forwarding rules, unusual sign-in locations and sudden changes in send volume catches what content filtering cannot, and mailbox rule creation in particular is one of the highest-value detections available in an email estate.

The controls in priority order

For an organisation improving email security, the sequence that delivers most first is reasonably consistent. Move DMARC to enforcement, which stops direct domain spoofing. Enable phishing-resistant multi-factor authentication, which addresses the account takeover that follows a successful lure. Monitor mailbox rule creation, which is the clearest compromise signal available.

Then add external sender marking so recipients can see at a glance that a message claiming to be internal is not, lookalike domain monitoring, and a one-click report button with a response process behind it.

Content filtering sits underneath all of these and is largely already present. The improvements above address what filtering structurally cannot catch, which is where the current losses are.

Where to start

Check your DMARC policy. If it is set to none, you are monitoring spoofing rather than preventing it, and moving to enforcement is the highest-value email security change available to most organisations.

See stopping business email compromise and why phishing still works. GuardsArm runs security risk assessments.