Blog

Email Security: Beyond Spam Filters

Image: cottonbro studio via Pexels

Most people think of email security as a spam filter problem — block the junk, let the good stuff through, job done. But modern email threats are far more sophisticated than that, and spam filters alone are no longer enough to keep your organisation safe.

A joint advisory issued just last month by CISA, the New Zealand NCSC, and the UK NCSC highlights exactly why this matters right now. Russian state-supported cyber actors have been running active phishing campaigns targeting users of the Zimbra Collaboration Suite email platform — and the authoring agencies are urging organisations to apply mitigations urgently. Whether you use Zimbra or not, the underlying lesson is the same: attackers are getting in through email, and technical controls at the authentication layer are your first real line of defence.

What Are SPF, DKIM, and DMARC?

These three protocols work together to verify that an email actually comes from who it claims to come from. Think of them as a layered identity check for your email domain.

• SPF (Sender Policy Framework) is a DNS record that lists the mail servers authorised to send email on behalf of your domain. If a message arrives from a server not on that list, receiving mail systems know something is off.
• DKIM (DomainKeys Identified Mail) adds a digital signature to outgoing emails — a cryptographic stamp that proves the message hasn’t been tampered with in transit. It’s like a wax seal on a letter.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together and tells receiving mail servers what to do when a message fails those checks — whether to quarantine it, reject it outright, or simply report it back to you. DMARC also gives you visibility into who is sending email using your domain, including any unauthorised parties.

Why Does This Matter for Your Organisation?

Without these controls in place, it’s surprisingly easy for attackers to send emails that appear to come from your domain — impersonating your organisation to staff, clients, or partners. This technique, known as domain spoofing, is a core tactic in phishing campaigns exactly like the one described in the joint advisory above.

For law firms, health organisations, NGOs, and government agencies — the kinds of organisations that handle sensitive client and personal information — a convincing spoofed email can have serious consequences. A staff member who receives what looks like an internal message asking them to click a link or share credentials has no easy way to tell it’s fake without these protections in place.

Getting the Settings Right

Implementing SPF and DKIM is a good start, but DMARC is where the real protection kicks in — and it needs to be configured at an enforcing policy level (quarantine or reject) to be effective. A policy set to “none” is monitoring only; it won’t stop spoofed mail from reaching inboxes.

The NCSC New Zealand’s guidance for organisations recommends email authentication as a foundational control, and it’s one we review as part of any security assessment we carry out for clients.

If you’re not sure whether your domain has SPF, DKIM, and DMARC correctly configured — or if you’d like a plain-English explanation of what your current settings actually mean — our team is always happy to help.

Simon Falconer
Director, Resolve Technology
When he’s not finding a reason to buy the latest gadget, Simon is probably setting it up, breaking it, and fixing it again — all before breakfast.