CYBCybersecurity

When fax was safer: SPF, DKIM and DMARC against email spoofing

Fax was not secure, but sending a million of them cost too much. Email wiped out that cost. Here is how three DNS records stop anyone from sending mail with your company’s domain, and what they leave uncovered.

Strategic editorial team 31 January 2026 8 min read

Cover: “When fax was safer than email”, Cybersecurity

Fax was safer not because of its technology but because of its economics. Every page cost paper, time and a phone call, and nobody could send a million of them in an hour. Email wiped out that cost. Without three records in the DNS, anyone can send mail using a company’s domain. SPF states which servers may send mail for that domain. DKIM signs the messages. DMARC ties both checks to the sender the recipient actually sees, and tells mail servers what to do with fakes. These records do not stop all phishing. They do take away the attacker’s most convincing disguise, which is the company’s exact address.

Nostalgia for a screech

Anyone who worked in an office in the 1990s remembers the fax. There was the screech of the line, the thermal paper curling up and the transmission report marked “OK”. It was not a private channel. It travelled over a phone line that anyone with a crocodile clip and a little patience could listen in on. Yet fax fraud stayed rare, for a mundane reason. It cost money. Every page needed a call, a sheet of paper and machine time.

The lesson still holds. Security is also a question of what pays for the attacker. When an attempt costs almost nothing and can be repeated endlessly, it only has to work now and then to be worth it. When it becomes awkward, the automated attacks move on to another target.

Why has email become the attacker’s favourite channel?

Because it costs almost nothing and can be automated. ENISA, the European Union Agency for Cybersecurity, published a report in October 2025. It names phishing as the main way in for the incidents analysed between July 2024 and June 2025, at around 60 per cent of cases. That figure includes variants carried out by phone and through online advertising. The same report notes that criminal groups are making growing use of artificial intelligence to work faster and better.

For a company, this has a practical consequence. The old advice to “be wary of messages full of mistakes” is worth less and less. A text written with AI is correct, polite and believable. What becomes decisive is the one thing the text cannot fake, provided the domain is protected. That is the address the message comes from.

What are SPF, DKIM and DMARC?

They are three standards published by the IETF, the body that defines internet protocols. They are set up as records in the DNS of the company’s domain.

Standard	What it does	What it does not do
SPF (Sender Policy Framework)	Lists the servers authorised to send mail for the domain	It does not check the sender the recipient sees. It often breaks when a message is forwarded
DKIM (DomainKeys Identified Mail)	Adds a digital signature to every message, which can be verified with a key published in the DNS	On its own, it does not say what to do with unsigned messages
DMARC	Requires SPF or DKIM to match the domain of the visible sender. It states how to treat messages that fail the check and sends reports to the domain owner	It does not stop lookalike domains, or genuine accounts that have fallen into someone else’s hands

DMARC was updated recently. In May 2026 the IETF published the new specification (RFC 9989). It replaces the 2015 version and moves DMARC onto the standards track proper.

Why can anyone use the company’s name without DMARC?

Because the sender shown in the mail program is just text written by whoever sends the message. SPF checks a different address, a technical one that the recipient never sees. Without DMARC, nobody checks that the two match.

A typical scenario. A supplier receives an email from accounts@ followed by the exact domain of one of its customers. It contains an invoice and new bank details. The message is sent from some server on another continent. If the customer’s domain publishes DMARC with a reject policy, the main email services turn it away or quarantine it before it reaches a person. If it does not, the message arrives with the right name and the right logo.

There is also a less visible benefit. A well-configured domain has a better reputation, and its genuine emails end up in spam less often.

How do you reach p=reject without blocking genuine mail?

DMARC has three levels. p=none only observes. p=quarantine sends suspicious messages to spam. p=reject refuses fake messages outright. The path can take weeks and follows six steps.

An inventory of everyone who sends mail in the company’s name. That means more than the mail servers. It includes the ERP system that sends invoices, the CRM, the newsletter platform, the customer service platform, the printers that email scans and the suppliers who write on the company’s behalf.
DMARC in monitoring mode, with reports switched on. The aggregate reports show who is using the domain, legitimately or not.
Fixes. Every legitimate service signs with DKIM on behalf of the domain, or is added to the SPF record. SPF, however, allows no more than ten DNS lookups. Beyond that limit the check fails.
Quarantine, then reject. Once the reports show only legitimate, aligned mail, you move to p=quarantine and finally to p=reject.
Subdomains and domains that send no mail. Domains that are registered but not used for email should declare that no server may send for them, with DMARC set to reject. Otherwise they become the most convenient disguise.
Maintenance. Every new service that sends mail goes through IT, and DKIM keys are changed at set intervals.

What do Gmail and Outlook now require from senders?

Since 1 February 2024, Google has required anyone writing to personal Gmail accounts to authenticate their mail with SPF or DKIM. Anyone sending more than 5,000 messages a day must have SPF, DKIM and DMARC, even if DMARC is only in monitoring mode. The sender’s domain must be aligned, and promotional messages must offer one-click unsubscribe.

Since 5 May 2025, Microsoft has required the same three checks from anyone sending more than 5,000 messages a day to Outlook.com, Hotmail and Live addresses. It rejects messages that fail them. For a company that sends invoices, notifications and newsletters, a well-configured domain is no longer just a defence. It is what gets the mail delivered.

What do these three records not solve?

Lookalike domains. DMARC protects the exact domain. A domain with one letter changed, or with an extra hyphen, is a different domain. The answer is to watch for new registrations of similar names and to teach staff to read the whole address.
The display name. “Head Office” can hide any address at all, and on a phone often only the name is shown.
Genuine accounts that have been breached. A message sent from a real mailbox after a password theft passes every check. That is the case described in the story of the reused password.
The content. DMARC tells you who sent a message, not whether the request is legitimate. A change of bank details must still be checked by phone, on a number you already know.

One last warning concerns AI assistants that read email. A fake message can contain instructions written for the assistant, not for the person. Cutting down forged messages helps, but it is not enough, as we explain on our page on AI security and governance.

In brief

Fax was protected by its cost. Email is not, and phishing remains the main way in for the incidents analysed by ENISA.
SPF lists the authorised servers and DKIM signs the messages. DMARC ties the checks to the visible sender and decides what happens to fakes.
You reach p=reject step by step. The steps are inventory, monitoring with reports, fixes, quarantine and reject.
Domains that send no mail need protecting too.
Gmail and Outlook require SPF, DKIM and DMARC from bulk senders. It is also a question of getting mail delivered.
Lookalike domains, breached accounts and payment requests remain a job for training and procedures.

Frequently asked questions

Does DMARC also block phishing from other domains?

No. It protects the domain that publishes it, by stopping others from using that domain as the sender. Against lookalike domains and breached accounts you need mail filters, attentive staff and procedures for checking payment requests.

Can moving to p=reject mean losing genuine email?

Yes, if a service that sends mail in the company’s name has not been configured. That is why you start with a monitoring phase. You move to reject only when the reports show that all legitimate mail passes the checks.

Does a domain that sends no email need DMARC?

Yes. A domain without records is a disguise available to anyone. Declaring that no server may send for that domain, and that its messages must be rejected, takes little work. It also takes a tool away from attackers.

Who handles this in the company?

IT does, together with whoever manages the DNS, marketing and the suppliers who send mail on the company’s behalf. Management’s job is to set one simple rule. No new service sends mail in the company’s name without going through that check.

Checking how email is configured, rebuilding the list of everyone who sends in the company’s name and seeing the change through until fakes are rejected are all part of the assessments carried out by our Cybersecurity division. For staff to recognise lookalike domains and unusual requests, you also need training and simulations for your people.

Sources

Consulted on 16 September 2026.

Find out moreCybersecurityTesting carried out the way an attacker would (penetration tests), incident management, business continuity and support in meeting NIS2 requirements, suppliers included.