Layered email security only works when each layer covers a different failure. See the coverage map, the DMARC enforcement gap, and the right buying order.
Layered email security works only when each layer covers a failure the others cannot. Authentication stops domain spoofing. Gateways stop known-bad content. Behavioral detection catches anomalies. None of them stop a payload-free message from a compromised account, which is why the human layer is part of the stack rather than a fallback.
Layering is usually described as adding products, and that framing is what produces stacks with three tools covering the same threat and none covering the next one. A layer earns its place by closing a specific failure mode the layers below it cannot see, which means the useful question about any email security purchase is not how good it is but what it catches that you are currently missing.
That question has a testable answer, because email attacks fall into a small number of structural categories: forged sender domains, lookalike domains, compromised legitimate accounts, malicious payloads, and payload-free social engineering. Each category defeats a different control, and no single product covers all five.
Most organizations discover the gaps in the wrong order. They buy detection before finishing authentication, which means paying a subscription to catch messages that a correctly configured DNS record would have rejected for free. General principles are covered in email security best practices for CISOs.
The map below is the artifact most layered-security discussions leave out. Read it as a coverage matrix rather than a ranking, since the layers are not substitutes for one another.
| Layer | Stops | Does not stop | Typical cost |
|---|---|---|---|
| SPF, DKIM, DMARC at enforcement | Exact-domain spoofing of your own domain | Lookalike domains, compromised accounts, payload-free messages | DNS records plus reporting effort |
| MTA-STS and TLS-RPT | Downgrade and interception in transit | Anything about message content or sender intent | DNS and policy file |
| BIMI | Nothing directly; adds a verified visual signal once at enforcement | Any attack, on its own | Certificate plus DMARC enforcement |
| Secure email gateway or native filtering | Known-bad URLs, malware, commodity campaigns, bulk spam | Novel URLs, payload-free BEC, mail from trusted compromised senders | Per-seat licence |
| Behavioral or AI detection | Anomalous sender relationships, unusual message patterns, some BEC | Well-crafted messages within normal patterns; adds false positives | Per-seat licence |
| Workforce recognition | Payload-free requests, callback lures, pretexts no filter can score | Nothing technically; depends on attention under pressure | Training programme |
| Reporting and response | Dwell time after something lands | The initial delivery | Tooling plus process |
Two rows deserve attention. BIMI stops nothing by itself and is frequently sold as a security control; its value is that it requires enforcement first and gives users a consistent signal afterwards. And workforce recognition is the only row that covers payload-free social engineering, which is the category growing fastest. How the authentication rows interact is set out in SPF and DKIM in an email security strategy and what DMARCbis changes.
Email authentication is the cheapest layer in the stack and the one most often left half-built. EasyDMARC’s 2026 adoption report, analyzing 1,800,000 of the most-visited domains across snapshots from 2023, 2025, and early 2026, found valid DMARC records grew from 523,921 to 937,931, a rise of 79% in three years.
Publication is not protection, and the enforcement figures show the gap. Of those domains, 411,935 had moved to p=quarantine or p=reject, and only 159,691 met the stronger benchmark of p=reject combined with aggregate reporting. Valimail’s research puts it more bluntly, finding that 75% to 80% of domains with published DMARC records never reach enforcement, remaining at p=none for months or years.
Much of that growth was compliance-driven rather than security-driven. Google and Yahoo began requiring DMARC for bulk senders in February 2024, and Google’s email sender guidelines set authentication as a condition of delivery to personal Gmail accounts for domains sending 5,000 or more messages a day. Gmail moved from soft handling to rejecting non-compliant traffic at the SMTP level from November 2025. Organizations that published a record to keep their marketing mail deliverable did not necessarily do anything about spoofing.
The maturity gap between organization types is wide. Fortune 500 adoption reached 475 of 500 companies with more than 80% at enforcement policies, while Inc. 5000 companies showed 76.2% adoption but only 15.2% at p=reject, leaving more than half at monitoring only. Configuration guidance is in how to configure DMARC to stop spoofing and BEC.
One caveat on all of these numbers: published enforcement rates vary enormously between studies, from single digits to nearly 50% depending on which domain population is measured and whether inactive domains are counted. The direction is consistent across every dataset even where the magnitude is not, and the direction is that publication has outrun enforcement everywhere.
A DMARC policy of p=none instructs receiving servers to take no action on messages that fail authentication. It generates reports and nothing else. An organization sitting at p=none has visibility into who is sending mail as its domain, which is genuinely valuable, but attackers can still spoof that domain exactly as before, and messages that fail will still be delivered.
That distinction is routinely lost in compliance reporting, where the question asked is whether a DMARC record exists. The answer is yes for a majority of significant domains and the protective effect is close to zero for most of them. Monitoring is a stage in a rollout, not a destination.
Two practical obstacles keep organizations there. SPF lookup limits break silently once a domain accumulates enough third-party senders, and nobody wants to move to enforcement while legitimate mail might be failing. Both are solvable with aggregate reporting and a sender inventory, and neither is a reason to stay at monitoring indefinitely. Threatcop’s TDMARC handles the mechanics that usually stall a rollout, including SPF flattening to stay inside the lookup limit and DKIM management across senders, so the move from p=none to enforcement stops being the project that never gets scheduled. Tooling options are compared in DMARC monitoring services.
Gateways and native cloud filtering do real work against volume attacks, and they have three structural blind spots that no tuning closes.
Compromised legitimate accounts send from clean infrastructure with valid authentication and established reputation, so reputation-based controls score them as safe. The message really is from the partner it claims to be from, which is the same logic that makes compromised supplier mailboxes and reply chain attacks so effective.
Payload-free messages contain no link and no attachment, giving detonation and sandboxing nothing to examine. A request to change bank details, or a message carrying only a phone number, passes inspection because there is nothing inspectable in it.
Lookalike domains authenticate correctly, because the attacker owns them and configures them properly. DMARC protects your domain, not domains that merely resemble it, which is why domain monitoring is a separate activity from authentication. The pattern is described in why lookalike domains authenticate correctly.
Behavioral detection evaluates how a message fits the relationship it claims to belong to: whether the writing style matches the sender, whether the request is unusual for that correspondent, whether the sending domain is behaving differently than it has before. Against compromised accounts and BEC, this genuinely covers ground that signature and reputation controls do not.
The costs are worth stating because vendors rarely do. Anomaly models produce false positives, and false positives in email land on people who then learn to click through warnings, which erodes the value of every warning banner you show. The models are also opaque, so an analyst investigating a miss often cannot establish why the system scored a message as safe. And effectiveness depends on the model having enough history for a relationship, which makes new correspondents, the exact population BEC exploits, the weakest case.
None of that argues against the layer. It argues for buying it after the free layer is finished, and for measuring it against what it catches that authentication and filtering did not, rather than against total threats blocked. Selection criteria are discussed in evaluating AI phishing triage tools.
Describing people as the last line of defence gets the architecture backwards. For payload-free social engineering, the human layer is the only line, because every technical control in the stack is designed to inspect content that these attacks do not contain.
Treating it as a fallback also produces the wrong investment pattern: maximum spend on the layers that handle the shrinking category of attacks carrying detectable payloads, and an annual module for the category that is growing. A more defensible split allocates attention to where the uncovered risk sits, which the coverage table above makes visible.
Practically this means training on request shape rather than sender inspection, since sender checks fail against compromised accounts, and it means giving people a reporting path fast enough to matter. Recognition specifics are covered in spear phishing versus phishing and attachment-based phishing.
Order matters more than total spend, because each step narrows what the next one has to cover.
Inventory every domain you own, including parked, legacy, and acquisition domains, since unused domains are the easiest to spoof and the least monitored.
Publish DMARC at p=none with aggregate reporting on all of them, and read the reports rather than filing them.
Fix SPF and DKIM for every legitimate sender, flattening SPF where lookup limits bite, until authorized mail authenticates cleanly.
Move to p=quarantine, then p=reject, domain by domain, starting with parked domains where there is no legitimate mail to break.
Add MTA-STS and TLS-RPT, which are low effort and remain very rarely deployed even in well-regulated sectors.
Monitor for lookalike registrations, since this is the gap enforcement cannot close.
Then evaluate behavioral detection, measured against what it adds beyond the layers now in place.
Build recognition and reporting continuously, because it is the only control for the payload-free category and the slowest to develop.
Steps 1 through 5 cost DNS changes and staff time. Organizations that run them first usually find the business case for step 7 has changed, because the volume it needs to justify itself is smaller than it was.
Before the next email security renewal, check one thing: what DMARC policy is published on every domain your organization owns, including the ones nobody sends mail from. If any of them sit at p=none, you are paying a subscription to catch attacks that a DNS change would have rejected outright.
Then work the coverage map rather than the vendor list. Establish which of the five attack categories your current stack genuinely covers, and you will usually find the uncovered ones are payload-free social engineering and lookalike domains, neither of which the next detection subscription addresses.
See what your domains are actually sending and how much of it authenticates, then decide what the paid layers still need to cover. The order is the whole saving.
Layered email security is an architecture in which each control closes a failure mode the others cannot see: authentication protocols prevent exact-domain spoofing, gateways and native filtering block known-bad content, behavioral detection flags anomalous sender relationships, workforce recognition covers payload-free social engineering, and reporting reduces dwell time. Layering means complementary coverage, not multiple products scoring the same threats.
No. DMARC at enforcement stops attackers spoofing your exact domain, which is one attack category out of several. It does not stop lookalike domains, which the attacker owns and authenticates correctly, and it does not stop mail from genuinely compromised accounts, which authenticates correctly because it really is from that sender. DMARC is necessary and not sufficient.
Because moving to enforcement risks blocking legitimate mail, and most organizations lack a complete inventory of systems sending on their behalf. SPF lookup limits also break silently once enough third-party senders accumulate. Valimail research reported through 2026 indicates 75% to 80% of domains with DMARC records never reach enforcement. The fix is aggregate reporting plus a sender inventory rather than more caution.
Only partially. Classic BEC messages contain no link or attachment, so gateways have nothing to detonate or sandbox, and when they originate from a compromised legitimate account they also pass reputation and authentication checks. Behavioral detection helps where the request deviates from an established relationship pattern, but performs weakest on new correspondents, which is the population BEC targets most.
That is a cost and consolidation decision more than a security one, and it does not change your coverage map. Both gateways and native filtering handle known-bad content well and share the same blind spots around payload-free messages, compromised senders, and lookalike domains. Decide it on licensing and operations, then address the blind spots separately.
Shikha Mishra is responsible for driving the growth and adoption of TDMARC, a flagship product of Threatcop, across India, the Middle East, APAC, and the UK region. With her expertise, she helps organizations safeguard their domains so that no hacker can misuse them to send fraudulent emails, thereby protecting both their brand and reputation. She is passionate about enabling businesses to simplify the complexities of outbound email security through TDMARC’s comprehensive solution, allowing them to stay focused on what matters most to their success.
AI romance scams defeat every visual check. See the FBI 2025 loss data, why 77% of victims never saw...
Article 4 of the EU AI Act requires providers and deployers of AI systems to take measures supporting AI...
Shadow AI governance is the practice of finding, assessing, and managing the AI tools employees use without approval. Most...
