- Nationwide Digital Forensic & Cyber Investigation Services
Most email security programs fail in the same predictable places: authentication published but never enforced, multifactor deployed in a bypassable form, and logging that was never turned on until it was needed. This page covers the controls that measurably reduce compromise and the configuration choices that determine whether an investigation is even possible.
| Question | One line answer |
|---|---|
| Does SPF alone stop spoofing? | No. Without an enforced DMARC policy, a failing message is still commonly delivered. |
| Which multifactor method is safest? | Hardware security keys and platform passkeys, because they are bound to the legitimate site. |
| Are external sender banners useful? | Modestly, and they lose effect quickly as users habituate to them. |
| What is the most overlooked control? | Governance of OAuth applications that hold standing access to mailboxes and files. |
| Should mailbox auditing be on? | Yes, for every mailbox, along with the longest retention your licensing supports. |
| Does training solve phishing? | It helps, but technical controls carry the load. Assume some users will click. |
| Term | What it means |
|---|---|
| SPF | Sender Policy Framework. A DNS record listing the servers permitted to send mail for a domain. |
| DKIM | DomainKeys Identified Mail. A cryptographic signature on outbound messages that survives normal forwarding paths. |
| DMARC | A published policy telling receivers what to do with messages that fail authentication, and where to send reports. |
| Alignment | The requirement that the authenticated domain match the visible From domain. Without alignment, authentication does not prevent impersonation. |
| Phishing resistant MFA | Authentication cryptographically bound to the real site, so a proxy page cannot relay it. |
| Conditional access | Policy that evaluates user, device, location, and risk before granting or blocking a sign in. |
Domain authentication protects your customers and partners from messages that impersonate your domain. It does not protect your own users from inbound phishing that uses lookalike domains, which is why it is one layer rather than the answer.
| Control | What it does | Common failure |
|---|---|---|
| SPF | Authorizes sending servers by address | Too many lookups, or a permissive softfail that receivers ignore |
| DKIM | Cryptographically signs outbound mail | Not enabled on every sending service, or weak key length |
| DMARC | Instructs receivers how to handle failures and requests reports | Left permanently in monitoring mode, so nothing is ever blocked |
| BIMI | Displays a verified logo on authenticated mail | Attempted before DMARC enforcement is in place |
| MTA-STS and TLS-RPT | Enforces encrypted transport and reports failures | Rarely deployed, leaving downgrade paths available |
Since adversary in the middle phishing defeats app based multifactor authentication, identity architecture now matters more than mail filtering. The controls below address the specific techniques seen repeatedly in business email compromise investigations.
Security keys and platform passkeys are bound to the legitimate origin, so a relay proxy cannot complete the exchange.
Older protocols that cannot enforce modern authentication remain a favored bypass and should be disabled tenant wide.
Device compliance, location, and risk signals block sessions that fall outside normal patterns even with valid credentials.
Shorter session lifetimes and a practiced revocation procedure limit how long a stolen token remains useful.
Restrict user consent, review applications holding mailbox permissions, and alert on new grants.
Administrative accounts should be dedicated, key protected, and excluded from routine mail use.
Every business email compromise that results in loss passes through a payment approval step. Out of band verification of banking changes using a known telephone number, dual approval above a threshold, and a policy that email alone never authorizes a change in payment instructions will stop the loss even when the mailbox is compromised.
We assess authentication, identity, and logging configuration against what we actually see in breach investigations.
Preventive controls reduce the odds. Logging determines what you can prove when the odds do not go your way. Audit configuration is never retroactive, so the settings in place before an incident define the ceiling on any later investigation.
Regulators, carriers, and opposing counsel increasingly evaluate whether reasonable controls were in place before the incident. A documented program is both a preventive measure and a legal position.
Review DMARC reports, sender inventory, and any authentication drift introduced by new vendors.
Audit OAuth applications with mailbox or file permissions and remove anything unused or unrecognized.
Test the account compromise runbook end to end, including session revocation and evidence export.
Independent assessment of tenant configuration and logging readiness, documented for carriers and regulators.
Track phishing simulation and reporting rates as a signal, without treating training as the primary control.
A record in monitoring mode instructs receivers to do nothing. Protection begins at quarantine and reject.
App and SMS factors are relayed by modern phishing kits. Hardware bound factors are not.
Training reduces click rates but cannot be the control of record when a convincing proxy page is involved.
Default audit retention and consent settings are frequently the reason an investigation cannot answer basic questions.
| Method | Resists relay phishing | Resists SIM swap | Practical note |
|---|---|---|---|
| SMS one time code | No | No | Better than nothing, but the weakest common option |
| Authenticator app code | No | Yes | Relayed in real time by proxy phishing kits |
| Push with number matching | Partially | Yes | Reduces fatigue attacks but can still be relayed |
| Platform passkey | Yes | Yes | Origin bound and widely supported on modern devices |
| Hardware security key | Yes | Yes | The strongest option for administrators and finance staff |
We assess email security from the perspective of investigators who spend their time reconstructing compromises after the fact. That means we test the configuration choices that determine both whether an attack succeeds and whether you can prove what happened when one does.
Review of authentication, conditional access, consent policy, and audit settings against observed attacker techniques.
Sender inventory, alignment remediation, and a staged path from monitoring to reject without disrupting business mail.
Verification that the logging needed to answer post incident questions is enabled, retained, and exportable.
Prioritized remediation after a compromise, tied to the specific technique used against you.
Documentation of controls in the form insurers and enterprise customers expect to see.
Process design for out of band verification and dual approval on banking changes.
Consultations are confidential. We work directly with affected businesses, with outside counsel, and with cyber insurance carriers and brokers nationwide.
Elite Digital Forensics is an independent digital forensics firm serving businesses, attorneys, and insurers nationwide. Our examiners include former law enforcement forensic examiners who have testified as court qualified expert witnesses in state and federal proceedings. We do not sell security software and we do not manage client networks, so our findings carry no conflict of interest when the question is whether an environment was adequately secured.
Every engagement follows documented chain of custody, defensible acquisition methods, and reporting written for attorney review, insurer submission, regulator response, or courtroom use. Work performed at the direction of counsel is generally treated as attorney work product prepared in anticipation of litigation. Call (833) 292-3733 or request a confidential consultation.
Phishing resistant multifactor authentication using hardware security keys or platform passkeys, deployed at minimum for administrators, finance, executives, and anyone with access to regulated data. It removes the session relay technique that defeats app based factors in most modern business email compromise cases.
No. DMARC prevents others from sending mail that appears to come from your domain, which protects your customers and partners. Inbound phishing usually arrives from lookalike domains or already compromised third party mailboxes, which DMARC on your own domain cannot address.
Keep them for at least one year where licensing allows, and export to independent storage for longer. Median discovery time for intrusions is measured in months, so a 30 or 90 day window frequently expires before anyone knows to look.
Yes. A consented application retains access to mailbox and file data through password resets and multifactor changes. Consent phishing is a well established technique, and unreviewed application permissions are among the most common findings in our assessments.
It has value for reporting rates and general vigilance, but it should never be the primary control. Modern proxy phishing pages are visually identical to the real login, so a program that depends on users detecting them is a program that will eventually fail.
Enforce DMARC, deploy phishing resistant authentication to high risk roles, disable legacy authentication protocols, restrict user OAuth consent, enable mailbox auditing everywhere, and require out of band verification for any change to payment instructions.
This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder