- Email is the initial attack vector in the majority of breaches. Phishing, business email compromise, and malware delivery all start with a message in someone’s inbox.
- SPF, DKIM, and DMARC are DNS records that together stop attackers spoofing your domain. DMARC at
p=rejectis the end state; most organisations sit atp=nonefor years longer than they should. - MFA on email accounts is not optional. Credential phishing is the most common way attackers access mailboxes; without MFA, a single clicked link hands them the account.
- Business email compromise causes more financial loss than any other email threat. The critical defence is a process: no payment change instruction is acted on without out-of-band verification.
- Email filtering reduces the volume of malicious messages reaching users but does not eliminate it. Staff training closes the gap.
Why email is still the biggest attack surface
Every employee has a mailbox. Attackers know this. Email carries links, attachments, and requests for action, which is exactly what credential phishing, BEC, and malware delivery need to work.
Three attack types account for most of the damage:
- Phishing: messages designed to trick recipients into clicking a malicious link, handing over credentials, or downloading malware. Spear phishing targets specific individuals with personalised content.
- Business email compromise (BEC): attackers impersonate a supplier, colleague, or executive to redirect payments or extract sensitive data. No malware involved, just a convincing email and a process that does not verify.
- Malware delivery: attachments or links that install ransomware, remote access tools, or information stealers when opened.
SPF, DKIM, and DMARC: the authentication stack
SPF, DKIM, and DMARC authenticate outbound email and tell receiving servers what to do when a message fails that check. Configure them in order.
SPF (Sender Policy Framework)
An SPF record lists the IP addresses and mail servers authorised to send email from your domain. A basic SPF record for a Microsoft 365 organisation:
v=spf1 include:spf.protection.outlook.com -all
The -all at the end means: reject messages from any server not on this list. Common legitimate sending sources beyond your primary mail provider include marketing platforms (Mailchimp, HubSpot), CRM systems, and transactional email services (SendGrid, Postmark). Include all of them before moving to -all.
DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic signature to outbound email. The sending server signs each message with a private key; the corresponding public key is published in your DNS. Receiving servers verify the signature to confirm the message genuinely came from your domain and has not been tampered with in transit.
In Microsoft 365, enable DKIM under Security > Email & Collaboration > Policies & Rules > Threat Policies > DKIM. Microsoft generates and manages the key pair; publish two CNAME records in your DNS pointing to Microsoft’s infrastructure.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC tells receiving servers what to do when a message fails SPF or DKIM checks, and instructs them to send reports back to you. Start at monitoring stage:
v=DMARC1; p=none; rua=mailto:[email protected]
Once you are confident your SPF and DKIM capture all legitimate sources, move to quarantine and then reject:
v=DMARC1; p=reject; rua=mailto:[email protected]
p=reject is the end state. Messages that fail DMARC are rejected outright, stopping attackers from spoofing your domain in phishing campaigns.
DMARC adoption has grown but many organisations publish a monitoring record and never progress to enforcement. The gap is usually legitimate email sources not captured in SPF: a marketing platform, a CRM, an old newsletter system. Work through your DMARC reports to identify and authorise legitimate senders, then move to quarantine and reject. Staying at p=none means your domain can still be spoofed.
MFA on email accounts
Credential phishing hands attackers a valid username and password. Without MFA, that is enough to access the mailbox, read email, set forwarding rules, and move to the next target. With MFA, stolen credentials do not authenticate.
For Microsoft 365, enable MFA through Conditional Access policies or Security Defaults. Require MFA for all users, including non-administrators. Authenticator apps (Microsoft Authenticator, Google Authenticator) are more phishing-resistant than SMS codes. FIDO2 hardware keys go further by binding authentication to the specific site and will not authenticate against a phishing page.
Email filtering and threat protection
| Control | What it does | Microsoft 365 |
|---|---|---|
| Anti-spam filtering | Blocks bulk email and known spam patterns | Exchange Online Protection (EOP) |
| Anti-phishing policies | Detects impersonation of users and domains; adds safety tips | EOP + Defender for Office 365 Plan 1 |
| Safe Links | Rewrites URLs and checks them at click time against threat intelligence | Defender for Office 365 Plan 1 |
| Safe Attachments | Opens attachments in a sandbox before delivering to the user | Defender for Office 365 Plan 1 |
| Attack simulation training | Sends simulated phishing campaigns to users; tracks who clicks | Defender for Office 365 Plan 2 |
For most UK businesses on Microsoft 365, Defender for Office 365 Plan 1 (included in Business Premium) provides a meaningful uplift over EOP defaults. Enable Safe Links and Safe Attachments with real-time scanning rather than time-of-delivery scanning only.
Business email compromise: the process problem
Business email compromise is the attack that causes the most financial loss because it bypasses technical controls. The attacker sends a well-crafted email requesting a payment change or transfer. By the time the fraud is identified, the money has moved.
Technical controls that reduce BEC exposure: DMARC at p=reject prevents your domain being spoofed; anti-impersonation policies flag emails from look-alike domains; external email banners flag messages from outside your organisation; blocking auto-forwarding rules to external addresses.
The control that blocks most BEC attempts has nothing to do with technology: no payment change instruction received by email gets acted on without a phone call to a number you already have on file. Not the number in the email.
Standard phishing training focuses on suspicious links and attachments. BEC emails have neither. They look like normal messages from known contacts. Add BEC scenarios to your simulation programme: fake invoice changes, fake CEO payment requests, fake HR benefit updates.
Email security baseline checklist
| Control | Status to achieve |
|---|---|
| SPF record published | All legitimate sending sources included; -all qualifier |
| DKIM enabled | Enabled for all sending domains |
| DMARC record published | p=reject; rua reporting configured |
| MFA on all mailboxes | Enabled for all users; app-based or phishing-resistant |
| Email filtering | Safe Links and Safe Attachments enabled; real-time scanning |
| Anti-impersonation policies | Key executives and domains protected |
| External sender labelling | Banners on external email enabled |
| Auto-forward blocking | Outbound forwarding to external addresses blocked by policy |
| BEC process controls | Out-of-band verification required for payment changes |
| Phishing simulation programme | Running quarterly at minimum; click-to-report trend tracked |
Ryland has delivered cybersecurity, compliance, and IT management programmes for regulated organisations across the UK and the Netherlands for over 20 years. View full profile