NexusSec.Why this matters commercially
Business email compromise is one of the most financially damaging attacks Indian businesses face, and it rarely involves malware. An attacker sends an invoice that appears to come from your finance team, or an urgent payment request that appears to come from a director. Without email authentication, nothing technically prevents that message being delivered.
The damage is not only financial. When your customers receive convincing fraud in your name, the reputational cost outlasts the fraud itself.
The three standards
Explained fully in what is DMARC, in brief:
- SPF — a DNS record listing which servers may send mail for your domain.
- DKIM — a cryptographic signature proving a message genuinely came from you and was not altered.
- DMARC — requires the visible "From" address to align with what SPF or DKIM validated, tells receivers what to do with failures, and provides reporting on everyone sending mail as your domain.
Why organisations get stuck
p=reject immediately, which silently stops legitimate mail from systems nobody remembered — the CRM, the invoicing platform, the marketing tool; or publishing p=none and never progressing, which provides reports nobody reads and no protection whatsoever. A DMARC record at p=none stops exactly zero spoofing.Our staged rollout
- Sender discovery. We identify every system legitimately sending mail as your domain — mail platform, CRM, ERP, invoicing, marketing, monitoring alerts, transactional mail. Nearly every organisation discovers senders it had forgotten.
- SPF. A single, correct record covering all legitimate senders, staying within DNS lookup limits — a common technical pitfall.
- DKIM. Signing enabled at each sending platform, with keys published and verified.
- DMARC at
p=none. Published with reporting addresses. Delivery is unchanged; reports begin. - Report analysis. Two to four weeks reviewing which sources pass, which fail, and which are unauthorised. We fix legitimate senders that fail.
- Progress to
p=quarantine. Failing mail is treated as suspicious. Continued monitoring. - Reach
p=reject. Spoofed mail is refused outright — the point at which you are genuinely protected. - Ongoing monitoring — new senders appear as the business adopts new tools, and must be authorised.
Additional hardening we implement
- MTA-STS — enforcing TLS for inbound mail delivery
- TLS-RPT — reporting on mail transport security failures
- BIMI readiness — where you wish to display your logo in supporting mail clients, which requires DMARC at enforcement
- Lookalike domain monitoring — DMARC cannot stop
yourc0mpany.com; identifying registrations early can - Mailbox MFA review — because a compromised mailbox sends mail that passes authentication legitimately
What DMARC does not solve
DMARC prevents impersonation of your domain. It does not stop phishing from lookalike domains, and it cannot help when a genuine mailbox is compromised — that mail authenticates correctly because it really is your account. Email filtering, multi-factor authentication on mailboxes, and user awareness remain necessary alongside it.
Cost and effort
This is DNS configuration and platform settings rather than a product purchase, which makes it one of the highest-return security controls available. The effort is concentrated in sender discovery and the monitoring period — typically six to ten weeks from start to enforcement, most of it waiting and verifying rather than active work.