Skip to main content
Email remains the single most exploited attack vector in enterprise security. Business email compromise, phishing, and brand impersonation attacks all depend on one thing: the ability to send email that looks like it comes from you. SPF, DKIM, and DMARC are the three DNS-based controls that prevent unauthorized senders from impersonating your domain — but only when they are correctly configured and enforced. Weak or missing records allow attackers to send phishing emails to your customers, partners, and employees that pass spam filters, carry your domain name, and show no visible warning. Leverage Cyber analyzes your email authentication configuration across every domain and subdomain in your footprint and surfaces every gap that creates spoofing exposure.

​
What Leverage Cyber Checks

Email security analysis covers every domain associated with your organization, not just your primary sending domain. Checks include:
  • SPF record presence and policy strength — whether an SPF record exists, which senders are authorized, and whether the policy enforces a hard fail (-all) or soft fail (~all) for unauthorized senders
  • DKIM selector discovery — whether DKIM signing keys are published in DNS, which selectors are active, and whether any selectors correspond to services no longer used
  • DMARC policy and reporting configuration — whether a DMARC record exists, whether the policy is set to none (monitoring only), quarantine, or reject (full enforcement), and whether a reporting address is configured to receive aggregate and forensic reports
  • BIMI configuration — whether a Brand Indicators for Message Identification record is present and properly linked to a verified mark certificate, which both strengthens deliverability and signals authentication maturity
  • MX record exposure — identification of your mail exchange providers, mail routing configuration, and any secondary MX entries that may represent legacy or unmonitored mail paths

​
Understanding Your Email Security Score

Each DNS record type serves a distinct role in preventing email impersonation. The examples below illustrate the difference between configurations that leave you exposed and configurations that provide full protection. SPF — Sender Policy Framework SPF authorizes specific IP addresses and sending services to send email on behalf of your domain. The enforcement qualifier at the end of the record determines what happens when an unauthorized sender attempts delivery.
A ~all softfail instructs receiving mail servers to accept the message but mark it as suspicious — in practice, most email providers deliver softfail messages to the inbox without any warning to the recipient. A -all hardfail instructs receiving servers to reject the message outright. If your SPF record ends in ~all, attackers can send email from your domain and have it delivered successfully to most recipients. DKIM — DomainKeys Identified Mail DKIM adds a cryptographic signature to outgoing messages, published as a DNS TXT record under a selector subdomain. The receiving mail server fetches this public key and uses it to verify the message was not altered in transit and genuinely originated from an authorized sender.
When a DKIM selector is active but the corresponding DNS record is missing or malformed, messages sent through that service lack a valid cryptographic signature. This makes it easier for attackers to forge or tamper with email headers in transit without detection. Leverage Cyber discovers DKIM selectors by analyzing mail headers in public datasets and certificate records, then verifies whether the published key is present, correct, and corresponds to a service still in use. DMARC — Domain-based Message Authentication, Reporting & Conformance DMARC ties SPF and DKIM together and defines what receiving mail servers should do when a message fails authentication. Without DMARC enforcement, even a correctly configured SPF record can be bypassed through header spoofing.
A p=none DMARC policy means no action is taken against messages that fail authentication — it is a monitoring-only configuration that provides visibility but zero protection. A p=reject policy instructs receiving servers to discard unauthenticated messages entirely. Most organizations have DMARC records in place but leave the policy at none indefinitely, providing the appearance of email security while delivering none of the protection.

​
Risk Levels

Email security findings are included in your initial 48-hour assessment. Your report contains the specific DNS records Leverage Cyber observed for each of your domains at the time of assessment — including the exact SPF qualifier, DMARC policy value, and any DKIM selectors discovered. This gives your email or DNS administrator the exact values needed to begin remediation immediately, without requiring additional investigation.