Email trust and compliance

The attacker pattern

An attacker sends email claiming to be from ceo@example.com using a server you do not control. If your domain has no DMARC enforcement policy, most receivers deliver the message to the inbox without complaint. The recipient sees your real domain in the From: header, trusts the message, and gets phished. The attacker never had to register a lookalike. They used yours.

This is the other half of brand impersonation: not registering a fake version of your domain (see typosquatting) but spoofing the real one. Defense is publishing the right DNS records and enforcing them. The protocol stack is DMARC, SPF, DKIM, MTA-STS, and TLS-RPT. The hard part is getting to a policy strict enough to block attackers without blocking your own marketing email along the way.

How PhishFence gets you to enforcement

1. 1

   Publish a DMARC record pointing reports at PhishFence

   One DNS record on _dmarc.[domain] with p=none and a rua address you control. Receivers start mailing aggregate reports daily within 24 hours; no traffic is filtered yet.

2. 2

   Daily DMARC report ingest with sender attribution

   PhishFence parses every aggregate (rua) and forensic (ruf) report, deduplicates, and enriches each sending IP with PTR, ASN, and ESP attribution. Instead of staring at 209.85.220.41, you see "Google Workspace" or "SendGrid (acme-corp instance)." Unknown senders pop immediately.

3. 3

   Posture score per domain across the full protocol stack

   A single score across DMARC, SPF, DKIM, MTA-STS, and TLS-RPT tells you exactly which records are weak, which are missing, and which ones attackers love to exploit. The dashboard ranks gaps by impact so you fix what matters first instead of chasing every yellow check.

4. 4

   Enforcement wizard gated on real alignment

   The wizard refuses to advance you from p=none to quarantine until every real sender you have marked as allowed is currently aligning on SPF or DKIM. Same gate from quarantine to reject. No more guessing whether tomorrow's marketing email gets blocked.

5. 5

   MTA-STS and TLS-RPT close the transport-layer gap

   PhishFence generates a valid MTA-STS policy plus matching DNS records so mail to your domain is delivered over TLS only. The companion TLS-RPT receiver parses failure reports from receivers, so a quiet downgrade attack never slips past you. Both are required for the strictest sender-requirement frameworks.

What it looks like in PhishFence

Common pitfalls to avoid

• Publishing p=reject on day one. Tempting because it is the strict policy, but most domains have at least one legitimate sender that is not aligning yet (a marketing tool with the wrong SPF include, a transactional sender DKIM-signing with the wrong selector). Going straight to reject silently drops real mail. Always sit at p=none for at least a week first.

• SPF PermError: too many DNS lookups. RFC 7208 caps SPF evaluation at 10 DNS lookups including nested includes. Google Workspace plus SendGrid plus Mailchimp blows past the cap on its own. The fix is SPF flattening: resolve all the includes at publish time into a static list of IP ranges, which counts as one lookup. Use the SPF flattener in the Related tools section below.

• Confusing SPF / DKIM pass with DMARC alignment. A message can pass SPF and still fail DMARC if the SPF-authenticated domain does not match the From: header domain. Strict alignment requires exact match; relaxed alignment allows subdomain match. Most receivers default to relaxed. If you publish strict alignment without checking your senders first, every ESP using its own envelope-from will fail DMARC even though SPF passes.

• Ignoring TLS-RPT. MTA-STS by itself enforces TLS, but you only learn about delivery failures if you publish a TLS-RPT record and someone is parsing the reports. A quiet downgrade attack (or an MTA misconfiguration on a receiver side) silently drops messages until somebody notices. PhishFence parses TLS-RPT reports automatically; turn it on the same day you publish the MTA-STS policy.

Which PhishFence tier?

Related tools & guides