No single tool stops business email compromise. A workable stack combines email authentication (SPF, DKIM, DMARC), multi-factor authentication, mailbox monitoring, filtering for lookalike senders, and payment verification procedures. Each one blocks a different route, so know what each one misses before you rely on it.
What do SPF, DKIM and DMARC do?
They let a domain owner state which servers may send mail for the domain, and let receivers check.
SPF, in RFC 7208, lets an organization explicitly authorize the hosts allowed to use its domain names and lets a receiving host check that authorization. DKIM, in RFC 6376, adds a cryptographic signature that a receiver validates against a published key. DMARC, in RFC 7489, lets the domain owner publish a policy for messages that fail those checks, ranging from no action through altered delivery to rejection, and asks receivers to send reports back.
NIST SP 800-177 Rev. 1, Trustworthy Email, recommends these mechanisms together with TLS for transport and S/MIME for message content.
What they miss: a lookalike domain that you do not own, and any mail sent from a real, compromised mailbox. Both can pass every check.
Which technologies cover those gaps?
- Multi-factor authentication on mailboxes. This blocks many account takeovers that start with a stolen password. Prefer phishing-resistant methods for finance and administrator accounts.
- Mailbox audit logging and alerts. Look for new forwarding rules, new inbox rules, unusual login locations and mass reads.
- Inbound filtering that flags display name impersonation, newly registered or lookalike domains, and first-time senders asking for payment changes.
- Domain monitoring for registrations that resemble yours.
- Banking controls: dual approval, payee confirmation, and recall procedures.
The last item is not software at all, and it is the strongest. A call to a known number defeats a message that is technically perfect.
What does a layered setup look like?
A constructed small company: twelve people, one finance clerk, a cloud email suite.
On day one they publish SPF and DKIM, then set DMARC to monitoring and read the reports for a month. Once legitimate senders such as the invoicing tool are aligned, they move the policy to reject. They enforce multi-factor authentication for all staff. They add an alert for new forwarding rules. They write a one page rule: any change to bank details needs a callback to the number in the contract file, logged by the clerk.
Total cost is mostly attention. The reject policy protects their customers from forgeries of their name. The alert and callback protect the company itself.
How to check or apply this
- Look up your domains' SPF, DKIM and DMARC records and confirm each exists and matches your real senders.
- Move DMARC from monitoring to enforcement once reports show legitimate mail passes.
- Check that multi-factor authentication covers every mailbox, including shared and service ones.
- List mailbox forwarding and inbox rules across the organization and remove what nobody can explain.
- Test your payment callback procedure with a harmless drill.
- Review after each incident and each change of email provider.
How do you roll out DMARC without breaking mail?
Start with a monitoring policy that asks receivers to take no action and send reports. Read the reports for several weeks. They list every source sending mail as your domain, including forgotten ones: the marketing platform, the support desk, the old billing system.
Fix each legitimate source so it passes SPF or DKIM aligned with your domain. Move to a quarantine policy, then to reject, watching the reports at each step. Skipping the monitoring stage is the usual way teams block their own invoices.
Plan an owner for the records. DNS entries drift when vendors change, and a stale SPF record can fail legitimate mail silently.
What about AI-written phishing?
Better prose makes lures harder to spot by reading alone, which is another reason to rely on procedure and authentication, not on staff noticing awkward grammar. A change of bank details is suspicious regardless of how well it is written.
Quick check
Is DMARC enough to stop spoofing of my domain?
It stops exact domain forgery when set to an enforcing policy and when receivers honor it. It does not cover lookalike domains or compromised accounts.
Which control is most effective against payment fraud?
A verified second channel callback for payment changes. It works even when the email is perfect and passes every technical check.
Sources
- RFC 7208: Sender Policy Framework
- RFC 6376: DomainKeys Identified Mail Signatures
- RFC 7489: DMARC
- NIST SP 800-177 Rev. 1: Trustworthy Email
- FBI IC3 PSA on business email compromise
Last reviewed: 18 October 2026.
