Email Threat Protection

Definition

Email threat protection encompasses the security practices and technologies that defend an organisation's email domain from abuse by malicious actors. Domain spoofing — where attackers send emails that appear to come from a legitimate domain — is the foundation of most email-borne attacks including phishing, Business Email Compromise (BEC), and impersonation fraud. The FBI's Internet Crime Report consistently ranks BEC as the most financially damaging cybercrime, with losses exceeding £2 billion annually. Email threat protection addresses this through authentication enforcement (SPF, DKIM, and DMARC), monitoring, and incident response procedures that limit an attacker's ability to impersonate the domain.

DMARC enforcement at p=reject is the single most effective protection against domain spoofing. When DMARC is enforced, receiving mail servers reject email that fails both SPF and DKIM authentication — precisely the characteristic of most spoofed messages. Beyond DMARC, threat protection includes monitoring DMARC forensic (RUF) reports that contain copies of failed messages, enabling analysis of attack content and techniques. Impersonation detection extends beyond domain spoofing to include display-name spoofing (where the From name mimics a trusted contact even if the domain does not match) and lookalike domains (where attackers register domains visually similar to the legitimate one). Comprehensive threat protection also includes internal procedures for reporting suspected email abuse, analysing attack patterns, and coordinating with domain registrars, hosting providers, and law enforcement when attacks are detected.

Best Practices

• Enforce DMARC at p=reject on all domains that send email. Progress through monitoring, quarantine, and reject phases methodically. Maintain p=none only temporarily while identifying and remediating all legitimate sending sources. Document the enforcement timeline for each domain and track authentication pass rates monthly to ensure ongoing compliance.

• Monitor DMARC forensic (RUF) reports for attack intelligence. RUF reports contain the actual content of failed messages, enabling detailed analysis of attack campaigns. Use these reports to identify phishing templates, subject lines, sender patterns, and targeting methodologies being used against your domain. Share intelligence with industry peers through threat-sharing groups.

• Implement display-name spoofing protection alongside domain-level authentication. Configure email security gateways to flag or block messages where the display name matches executive names, financial department roles, or trusted vendor names even when the domain passes authentication. Train employees to verify the email address behind the display name on all unusual requests.

• Establish a domain abuse incident response procedure. Define roles for investigating reported spoofing, steps for evidence collection (headers, full message content, logs), escalation paths to legal and executive teams, and procedures for coordinating with takedown services. Test the procedure through tabletop exercises at least annually.

• Register lookalike domains defensively and monitor for new registrations. Identify the top 10-20 domain variations that could be used for spoofing and register them preventively. Use domain monitoring services to detect new lookalike domain registrations and initiate takedown procedures when malicious use is confirmed. Document the cost of defensive registration vs potential attack impact to justify the investment.