Not every risky email should be blocked outright. Some messages may be legitimate but still deserve extra scrutiny. Until now, email security has largely followed a simple model: a message is either delivered or blocked. While this works well for clearly malicious emails, many modern attacks operate in a gray area where the risk is real, but not high enough to justify rejecting the message.
Email remains the primary entry point for phishing, fraud, malware, and Business Email Compromise (BEC) attacks. While Microsoft 365 provides a strong foundation, organizations need additional layers of protection to defend against increasingly sophisticated threats
The email landscape has fundamentally changed — and in 2026, there is no ambiguity left:
DMARC is no longer optional. It is enforced.
Over the past two years, the world’s largest mailbox providers — Google, Yahoo, and Microsoft — have implemented strict authentication requirements. Today, any domain sending bulk email must have properly configured SPF, DKIM, and DMARC, or risk outright rejection. [mailcop.net], [redsift.com]
This shift marks the end of the “open email era” and the beginning of a trust-based ecosystem where authentication is mandatory.
Outbound Email Security Matters for Deliverability and Routing. Especially for organizations that need to deliver a large set of emails, and frequently (Transactional Emails) regarding, for instance, transaction receipts and payment notifications.
ARC isan email authentication system that preserves trust and integrity across intermediaries, ensuring legitimate emails are recognized even after multiple hops. It is an important setup for your email ecosystem!
With this 30-second summary, quickly understand what is DMARC all about and what you can do to protect your organization from common email threats.
The email security landscape is increasingly shaped by robust protocols for authentication, data protection, and secure communication. Among these, MTA-STS is emerging as a critical standard, strengthening the enforcement of encrypted channels for email delivery.
Phishing attacks, which trick users into revealing sensitive information or installing malware, have grown more sophisticated and localized. Putting it simple: the frauds you'll get in Portugal are completely different from US, Singapore or any other place.
As the largest players in the email space acknowledge the need for DMARC, the entire ecosystem will become restricted to the ones following the rules.
Kent Ickler // TL;DR: This post describes the process of building an active system to automatically recon SPF violations. Disclaimer: There are parts of this build that might not be legal […]
The post Offensive SPF: How to Automate Anti-Phishing Reconnaissance Using Sender Policy Framework appeared first on Black Hills Information Security, Inc..
Kent Ickler and Derrick Rauch* // Sun Protection Factor Err… wait a second. Sender Policy Framework Ladies and Gentlemen of the class of 1997, Wear Sunscreen…I will dispense my advice, […]
The post How to Configure SPFv1: Explained for the Masses appeared first on Black Hills Information Security, Inc..
Login