Key takeaway
Roll out sender-domain authentication in stages, and verify payments or bank-detail changes through an independent channel.
Email spoofing and BEC are different
The display name and address in the From field can look familiar without proving who sent the message. Email spoofing can forge the displayed sender name or address; BEC can also use a compromised real account or an intrusion into an existing conversation. Executive and supplier fraud often create an urgent, confidential request for money or data. Errors, pressure and unfamiliar links are warning signs, but polished writing and a familiar signature do not prove safety.
Executive impersonation
A message in an executive’s name requests an urgent transfer, gift cards or confidential data.
Compromised business account
A message may come from a real account; sender-domain checks alone do not detect account takeover.
Supplier-detail change
Verify changed bank details using a phone number already on file.
What SPF, DKIM and DMARC do
SPF publishes which hosts may use a domain in SMTP MAIL FROM and HELO/EHLO identities. DKIM signs selected parts of a message with a domain key. DMARC checks whether the visible From domain aligns with the domain from a successful SPF or DKIM check; one successful aligned check is enough. The domain owner can publish a handling policy and receive reports. These checks alone do not stop display-name impersonation, lookalike domains, compromised legitimate mailboxes or social engineering. Inventory every legitimate sending service, test DNS records, review reports and move to a reject policy only after checking domain alignment and fixing legitimate mail flows.
| Mechanism | Main purpose | Limit |
|---|---|---|
| SPF | Whether the host may use the domain in SMTP MAIL FROM or HELO/EHLO | Forwarding and third-party senders need careful handling |
| DKIM | Signed message parts and the domain key | The signing domain may differ from the visible From |
| DMARC | Alignment between From and SPF/DKIM identifiers, plus policy | Does not validate message safety or a person’s identity |
A Secure Email Gateway is one layer
An email gateway can apply reputation, spam and malware analysis, and link or attachment checks at mail ingress or egress; its capabilities depend on the product and configuration. Sandboxing suspicious files, quarantining messages with unsafe links and evaluating sender authentication help, but a gateway will not always stop account takeover, supplier-detail changes or a new lookalike domain. Add MFA, mailbox auditing, forwarding-rule monitoring, a phishing-reporting path, backups and transaction verification.
Verify financial changes outside email
Require a second confirmation for a new payee, bank-detail change, confidential file transfer or urgent executive request. Call a number already on file or use a separately approved system; do not trust a number or link in the email itself. A screenshot or display name is not verification. Where possible, enforce dual approval, limits, delays and recall procedures in the finance system. Report suspicious mail through the organization’s incident channel so headers and evidence are preserved.
Pause
Pause the payment or data transfer until the request is checked.
Use an independent channel
Use a known phone number, verified supplier portal or internal approval process.
Report the incident
Report the email to the security team. The team should preserve headers and records of forwarding rules, and revoke account sessions if needed.
Read suspicious message headers carefully
Compare the Received chain, Reply-To, Return-Path and SPF, DKIM and DMARC results in the full headers. For Authentication-Results, rely on results added by the organization’s trusted receiving server; externally supplied headers can be forged. Do not rely on the visible From line alone. A “pass” means a particular domain-authentication check succeeded; it does not establish the sender’s honesty or the message’s safety. SPF may behave differently with forwarding and DKIM may break when a message is modified, so evaluate results with alignment and the organization’s authorized-sender inventory. Urgent changes and payments still need separate confirmation.