SPF, DKIM and DMARC

Without an enforcing DMARC policy anyone can send invoices, password resets and instructions to your staff and customers from an address that looks exactly like yours. This is not a theoretical risk; it is the standard opening move of an invoice-redirection fraud.

The rollout has one correct order and skipping it breaks legitimate mail. Publish SPF and DKIM; publish DMARC at p=none with reports going somewhere a person reads; spend a few weeks finding every legitimate sender — the CRM, the invoicing tool, the newsletter, the booking system — and authorise each; then move to quarantine, then to reject.

p=none left in place for years

Monitoring mode is not protection. It reports impersonation without stopping any of it, and because nothing visibly breaks, it survives indefinitely. It is a stage in a migration, not a configuration.

Business email compromise

Fraud carried out through a real or convincingly forged company mailbox, usually to redirect a payment — and by value, the most damaging attack a normal business faces.

---

Account recovery path

The chain of accounts that can reset each other's passwords — and therefore the real security level of every account in it, which is the level of the weakest.

---

Two-factor and multi-factor authentication

Requiring a second proof of identity beyond the password — and the factors differ enough in strength that “we have 2FA” says almost nothing on its own.

All forty-five termsWhat this is regulated by in the UAE

Is this one right in your own numbers?

The definitions are the easy part. Whether the figure on your dashboard was computed this way is a different question, and usually the more expensive one.