Inventory every domain you own<\/strong>, including parked, legacy, and acquisition domains, since unused domains are the easiest to spoof and the least monitored.<\/p><\/li>\n\n\n\nPublish DMARC at p=none with aggregate reporting<\/strong> on all of them, and read the reports rather than filing them.<\/p><\/li>\n\n\n\nFix SPF and DKIM for every legitimate sender<\/strong>, flattening SPF where lookup limits bite, until authorized mail authenticates cleanly.<\/p><\/li>\n\n\n\nMove to p=quarantine, then p=reject<\/strong>, domain by domain, starting with parked domains where there is no legitimate mail to break.<\/p><\/li>\n\n\n\nAdd MTA-STS and TLS-RPT<\/strong>, which are low effort and remain very rarely deployed even in well-regulated sectors.<\/p><\/li>\n\n\n\nMonitor for lookalike registrations<\/strong>, since this is the gap enforcement cannot close.<\/p><\/li>\n\n\n\nThen evaluate behavioral detection<\/strong>, measured against what it adds beyond the layers now in place.<\/p><\/li>\n\n\n\nBuild recognition and reporting continuously<\/strong>, because it is the only control for the payload-free category and the slowest to develop.<\/p><\/li>\n<\/ol>\n\n\n\nSteps 1 through 5 cost DNS changes and staff time. Organizations that run them first usually find the business case for step 7 has changed, because the volume it needs to justify itself is smaller than it was.<\/p>\n\n\n\n
<\/span>Finish the Free Layer First<\/span><\/h2>\n\n\n\nBefore the next email security renewal, check one thing: what DMARC policy is published on every domain your organization owns, including the ones nobody sends mail from. If any of them sit at p=none, you are paying a subscription to catch attacks that a DNS change would have rejected outright.<\/p>\n\n\n\n
Then work the coverage map rather than the vendor list. Establish which of the five attack categories your current stack genuinely covers, and you will usually find the uncovered ones are payload-free social engineering and lookalike domains, neither of which the next detection subscription addresses.<\/p>\n\n\n\n
See what your domains are actually sending<\/a> and how much of it authenticates, then decide what the paid layers still need to cover. The order is the whole saving.<\/p>\n\n\n\n<\/span>Frequently Asked Questions<\/span><\/h2>\n\n\n\t\t\n\t\t\t
\n\t\t\t\t\t\t\t\t
\n \t \t\n\t\t\t
\n\t\t\t\t\n\t\t\t\t\t\t\t\t
<\/span>\n\t\t\t\t