Case Study Cutting Phishing with SPF DKIM DMARC

Corporate email shield formed by SPF, DKIM, and DMARC icons protecting a mailbox against phishing, with DNS symbols and a rising security chart in a modern flat design.

When a well-known professional services firm noticed a sudden spike in lookalike emails and invoice fraud attempts, they faced a familiar dilemma: how do you protect busy employees and clients from convincing email impersonation without slowing the business to a crawl? This case study walks through how the team systematically implemented SPF, DKIM, and DMARC to cut phishing by 82% in six months—while improving deliverability and preserving a seamless experience for legitimate senders.

Table of Contents

Background: The Rising Cost of Phishing

The organization in this case is a mid-sized professional services firm with about 2,000 employees and multiple client-facing brands. Over one quarter, the security team recorded a 3x increase in spoofed messages claiming to be from executives, HR, and billing.

Their existing email security gateway blocked many malicious messages, but attackers were increasingly abusing lookalike domains and forwarding paths, slipping past filters. The team needed a domain-level control that told receiving mail systems which messages were legitimately from them—and which were not.

Enter SPF, DKIM, and DMARC: a trio of open standards that authenticate sending sources, verify message integrity, and give domain owners a policy-based say in what happens to impostors.

Baseline and Objectives

Before making any changes, the team defined success and captured a baseline. They looked at:

  • Reported phishing emails per week (from employees and clients).
  • Security operations center (SOC) detections of spoofed domains.
  • Deliverability KPIs for campaigns (marketing, payroll notices, client updates).
  • Third-party senders in use (CRM, marketing platform, ticketing, payroll, newsletter tools).

They set three practical objectives for a six-month program:

  • Reduce impersonation of the primary domain by at least 70%.
  • Achieve a DMARC policy of quarantine by month four and reject for the primary domain by month six.
  • Maintain or improve deliverability for legitimate business mail.

SPF, DKIM, and DMARC in Plain English

SPF (Sender Policy Framework) tells receiving mail servers which IPs and services are allowed to send mail for your domain. Think of it as an approved sender list published in DNS.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message. Receiving servers use a public key in your DNS to verify that the message wasnt altered and truly came from an authorized sender.

DMARC (Domain-based Message Authentication, Reporting & Conformance) ties it all together. It requires messages to pass SPF or DKIM and align with the visible From domain. Then it lets domain owners specify a policy: do nothing (none), send to spam (quarantine), or reject. DMARC also provides reporting so you can see whos sending on your behalf and how many messages pass or fail.

In short: SPF = who can send, DKIM = message integrity, DMARC = enforce and report. These standards dont replace secure email gateways or awareness training, but they powerfully reduce domain spoofing.

Project Plan, Roles, and Timeline

The firm set up a small cross-functional working group:

  • Security engineering (lead): design, DNS changes, monitoring, policy.
  • Messaging/IT: MTA configuration, DKIM signing, vendor coordination.
  • Marketing & Communications: third-party sender inventory, testing.
  • Procurement/Vendor management: contracts and technical contacts.

They planned three phases across six months:

  1. Discovery & monitoring (weeks 1): inventory senders, publish DMARC at p=none, start collecting reports.
  2. Authentication rollout (weeks 42): implement SPF and DKIM for each sender; fix alignment gaps.
  3. Enforcement ramp-up (weeks 136): move DMARC to quarantine, then reject, with gradual percentage increases.

Step-by-Step Implementation

1) Inventory every legitimate sender

With DMARC reporting (RUA aggregate reports) enabled on day one, the team quickly identified all sources claiming to send from the domain, including forgotten tools used by departments. They also asked stakeholders to list any system that sends email externally.

  • Corporate M365 and on-prem relay
  • Marketing automation platform
  • CRM and support desk
  • HR/payroll notifications
  • Scanner/MFPs and facilities systems

2) Configure SPF correctly

The team published a single SPF record at the root domain, carefully including each authorized service. They avoided common pitfalls:

  • Only one SPF TXT record (multiple records break SPF).
  • Use of include: for vendor-maintained records rather than raw IPs.
  • Kept total DNS lookups at or below 10.
  • Ended with -all to explicitly fail non-authorized sources.

For subdomains used by specific tools (e.g., mail.brand.example.com), they created dedicated SPF records where appropriate and sometimes delegated sending to vendor-owned domains to simplify alignment.

3) Enable DKIM signing

Next, they enabled DKIM on the corporate mail system and each third-party platform. Key practices included:

  • Using 2048-bit keys where supported.
  • Unique selectors per sender (e.g., s1-m365, s1-mktg).
  • Rotating keys on a semi-annual schedule.
  • Ensuring the d= domain in DKIM signatures aligned with the visible From domain (or subdomain) for DMARC.

4) Turn on DMARC with monitoring

They published DMARC at p=none with RUA reporting to a vendor mailbox for analysis. This produced daily summaries of pass/fail rates by source, letting the team fix issues before blocking anything.

  • Address: v=DMARC1; p=none; rua=mailto:[email protected];
  • Alignment: started with relaxed alignment (adkim=r; aspf=r), tightening later where feasible.

5) Fix alignment gaps

DMARC requires SPF or DKIM pass and alignment with the From domain. The biggest fixes involved:

  • Updating vendors to sign DKIM with the companys domain, not the vendor default.
  • Changing some From addresses to subdomains dedicated to the tool (e.g., billing.example.com).
  • Shifting a few systems to rely on DKIM instead of SPF when messages were frequently forwarded (where SPF breaks).

6) Enforce gradually

With authentication stable, they moved to p=quarantine at 25%, then 50%, then 100% over four weeks. After two more weeks of monitoring, they switched to p=reject with pct=50, then 100%.

  • Mailbox-level sampling reduced risk while catching outliers.
  • They kept a few niche subdomains at p=none temporarily while vendors completed DKIM setup.

7) Optional enhancements

  • Set up RUF forensic reports to a controlled mailbox for deeper investigations (with privacy review).
  • Explored BIMI for primary brand to display a verified logo once DMARC reached enforcement.
  • Considered ARC support on inbound to improve handling of forwarded messages.

Technical Hurdles and Fixes

Several issues surfaced during rollout, each with a practical resolution:

  • Multiple SPF records: Legacy entries created duplicates. They consolidated into one record and used include: statements.
  • SPF lookup limits: Too many include: chains risked exceeding 10 DNS lookups. They pruned unused vendors and used vendor macro includes where offered.
  • DKIM selector collisions: A vendor reused a generic selector already in use elsewhere. They requested a custom selector and published a new DNS record.
  • Forwarding breaks SPF: Employee forwarding to personal mailboxes caused SPF fails. Relying on DKIM for alignment solved most cases.
  • Shared mailboxes and aliases: Some systems sent using the root domain From address while authenticating under a subdomain. They standardized From domains and tightened alignment.
  • DNS propagation latency: They scheduled changes during low-traffic windows and validated with external tools after TTLs expired.

Throughout, they used DMARC aggregate reports and sandbox mailboxes to validate changes before moving to stricter policies. Public resources like dmarc.org helped confirm recommended practices.

Results: Phishing Reduction and Deliverability

Within six months:

  • 82% reduction in spoofed messages reaching user inboxes for the primary domain.
  • 71% drop in business email compromise (BEC) attempts impersonating executives.
  • Fewer helpdesk tickets related to suspicious internal-looking emails.
  • Stable or improved deliverability for legitimate mail, with marketing open rates up 3% (less provider throttling and fewer soft bounces).

Equally important, they now had visibility. DMARC reports revealed unauthorized bulk senders and legacy apps still attempting to mail as the company. Those were either authenticated properly or shut down.

Metrics were collected from SOC logs, DMARC report analysis, email gateway stats, and user-reported phishing trends, giving leadership a clear before-and-after view.

Change Management and Training

Technology alone wasnt the full answer. The team paired the rollout with light-touch training:

  • Short guides explaining what changed and why email might land in spam during the transition.
  • Encouraging reporting of suspicious emails via a one-click add-in.
  • Notifying key client contacts about improved anti-spoofing protections.

This communication prevented confusion and reduced resistance when certain messages were quarantined during the enforcement ramp-up.

Lessons Learned and Best Practices

  • Start with visibility: Publish DMARC at p=none, collect reports, and map your real sender ecosystem before enforcing.
  • Inventory ruthlessly: Shadow IT and department tools often send mail. Find them early to avoid broken flows.
  • Prefer DKIM for alignment when forwarding is common. SPF is valuable, but forwarding can break it.
  • Use subdomains deliberately: Assign tools to subdomains to keep alignment clean and reduce risk to the root domain.
  • Enforce gradually: Increase pct in steps and monitor. Keep a rollback plan.
  • Watch SPF limits: Minimize include: chains and remove unused vendors.
  • Rotate DKIM keys: Establish a calendar and use unique selectors per platform.
  • Document everything: Track selectors, DNS records, owners, and vendor contacts. It pays dividends during audits and incidents.
  • Combine with user awareness: DMARC reduces domain spoofing but doesnt stop all phishing, especially via lookalike domains.

How to Get Started

If youre starting from scratch, a pragmatic path looks like this:

  1. Publish DMARC at p=none with RUA reports to a monitored mailbox or reporting service.
  2. Inventory all senders and enable DKIM for each. Fix alignment by adjusting From domains or vendor settings.
  3. Consolidate to a single, well-structured SPF record; keep lookups under 10.
  4. Move to p=quarantine with pct=25, then 50, then 100% as reports stabilize.
  5. Advance to p=reject with pct ramp-up. Maintain exceptions only where necessary.
  6. Maintain: review reports weekly, rotate keys, and update records when tools change.

Conclusion

By treating SPF, DKIM, and DMARC as a business project—not just a DNS tweak—this organization dramatically reduced impersonation risk without disrupting legitimate email. The combination of accurate sender inventory, careful configuration, gradual enforcement, and clear communication delivered measurable results and lasting operational clarity.

If youre ready to reduce phishing and protect your brand, start with DMARC monitoring, fix alignment systematically, and ramp to enforcement with confidence.

Frequently Asked Questions

Does DMARC stop all phishing?

No. DMARC blocks direct spoofing of your domain when enforced, but attackers can still use lookalike domains or compromised accounts. Pair DMARC with user training, MFA, and inbound filtering.

How long does a typical rollout take?

For a mid-sized organization, plan 81 weeks for discovery and authentication, then 612 weeks to ramp enforcement. Complex vendor landscapes or many brands can extend timelines.

Will enforcement hurt deliverability?

Done correctly, most organizations see equal or better deliverability. The key is to authenticate every legitimate sender and use a gradual pct ramp with continuous monitoring.

What if our marketing platform cant sign DKIM with our domain?

Use a dedicated subdomain they can authenticate (e.g., news.example.com) or have them send from a vendor domain that clearly identifies your brand, then update links and branding accordingly.

In

Leave a Reply

Your email address will not be published. Required fields are marked *