CertaDNS
Skip to lesson

Moving Toward Enforcement · lesson 4 of 4

What p=reject does not stop

After this lesson you can

Name the impersonation techniques that survive full DMARC enforcement, and say what does address them.

Assumes you have read The staged path to enforcement.

You have reached p=reject. Nobody can send mail with your exact domain in the From header any more. That is a genuine and substantial achievement, and it is worth being exact about its boundaries — because the most expensive outcome of a successful DMARC project is an organisation that now believes it has solved impersonation.

What it does stop

Exact-domain spoofing, completely and permanently. A message displaying From: ceo@acme.com that did not come from an authenticated Acme sender is refused at every receiver honouring the policy. That was the cheapest attack available against you, and it is gone.

What it does not stop

TechniqueWhat the reader seesWhy DMARC is not involved
Display-name spoofing"Acme CEO" <ceo@gmail-account.example> — and on mobile, often just "Acme CEO".The address genuinely belongs to the sender. Their own DMARC passes. Your policy is never consulted.
Lookalike domainsceo@acrne.com — r and n, not m.A different domain, with its own SPF, DKIM and DMARC, all passing. It is authenticated as itself.
Combosquattingbilling@acme-invoices.comAlso a different domain, and the brand name is spelled correctly so typo defences miss it.
Compromised accountsA real message from a real @acme.com mailbox.It authenticates perfectly, because it is genuine mail from a genuine account under someone else’s control.
Compromised supplierA real message from a real supplier, on a thread you were already having.Their domain, their authentication, all correct. The most effective invoice fraud works this way.

The claim to avoid making

"We have DMARC at reject, so we are protected from phishing" is the sentence to watch for. DMARC eliminated one technique. Business email compromise overwhelmingly uses the ones in the table above — precisely because they are unaffected by it, and increasingly because so many targets have deployed DMARC.

What addresses the rest

  • Display-name spoofing — receiver-side and user-side. External-sender warning banners, rules flagging a display name matching an internal person from an outside address, and training that teaches people to read the address rather than the name.
  • Lookalike domains — you cannot prevent registration, so the controls are detection and response: monitoring for permutations of your name, watching certificate issuance, and having a takedown route ready before you need it.
  • Compromised accounts — an identity problem. Multi-factor authentication, conditional access, anomaly detection on sending behaviour.
  • Compromised suppliers — a process problem. Payment changes verified out of band, over a channel not established by the message requesting the change.

Where this goes

The second and third of those are the subject of the Domain and Brand Security track, which starts from DNS itself and works up through DNSSEC, registrar control, dangling records and the impersonation techniques above. If you finish this course and stop, you have done the most valuable single thing available and you have done roughly half the job.

This course:     nobody can BE you
Next track:      nobody can convincingly RESEMBLE you,
                 and nobody can take away your ability to be you
Knowledge check

An organisation at p=reject receives a fraudulent invoice from finance@acme-billing.com. Their brand is Acme. The message passed SPF, DKIM and DMARC. What went wrong?

Try it on a real domain

Free, no account, public DNS only.

Last reviewed