Email security
Email is both a critical business channel and a top attack vector. Learn how SPF, DKIM, and DMARC establish sender trust, and how phishing, BEC, and related threats exploit gaps in people and process.
Start with essential reading for a fast overview, then move into deep dives and reference material as you need it.
Start with essentialsEssential reading
Business email compromise (BEC)
Business email compromise is a targeted social engineering attack that uses email impersonation and trust exploitation to divert payments, steal sensitive data, or manipulate business processes.
Email authentication
Email authentication combines SPF, DKIM, and DMARC into a layered defense that verifies sender identity and prevents domain spoofing, with BIMI emerging as a visual trust indicator built on top.
What is adversary-in-the-middle (AiTM) phishing?
AiTM phishing uses reverse-proxy tools to relay credentials and capture session tokens in real time, allowing attackers to bypass multi-factor authentication and hijack authenticated sessions.
What is DKIM?
DKIM uses cryptographic signatures to verify that an email's headers and body haven't been tampered with in transit, tying the message to a specific sending domain through DNS-published public keys.
What is DMARC?
DMARC ties SPF and DKIM together through domain alignment and adds a policy layer that tells receivers how to handle authentication failures, along with a reporting mechanism for visibility into email abuse.
What is OAuth phishing?
OAuth phishing tricks users into granting malicious applications persistent access to their email and files through legitimate-looking consent screens, bypassing traditional credential theft entirely.
What is phishing?
Phishing is the use of deceptive messages, primarily email, to steal credentials, deliver malware, or manipulate victims into actions that benefit the attacker. This guide covers phishing types, post-compromise escalation, common lures, detection signals, and the role of domain infrastructure in phishing campaigns.
What is SPF?
SPF is a DNS-based email authentication protocol that lets domain owners declare which mail servers are authorized to send on their behalf, helping receivers detect forged envelope senders.
Deep dives
Display name spoofing
Display name spoofing exploits the gap between what email clients show users and the actual sender address, allowing attackers to impersonate trusted contacts while passing email authentication checks.
Email account compromise (EAC)
Email account compromise occurs when attackers gain control of a legitimate mailbox and use it for internal phishing, data theft, and financial fraud, often remaining undetected for weeks.
What are phishing kits?
Phishing kits are pre-packaged toolkits that give low-skill attackers ready-made credential harvesting pages, backend exfiltration logic, and admin panels, commoditizing phishing at scale.
What is ClickFix?
ClickFix is a social engineering technique where fake error messages or CAPTCHAs instruct users to paste attacker-supplied commands into their system's Run dialog or terminal, bypassing traditional email and web security filters.
Put what you learn into practice
Monitor typosquats, investigate infrastructure, and move from reading to detection with continuous domain coverage built for security teams.