SPF, DKIM and DMARC: stop attackers from sending email in your company's name
Fake invoices and "urgent" messages from the director are among the most common attacks. Three DNS records make them much harder.
Read articleFirewalls and antivirus protect a lot, but attackers know that the easiest way into a company is through a person. A convincing email, an urgent message in a messenger or a fake login page is often enough to steal a password or install malware. The good news: most phishing messages share the same warning signs.
Seven warning signs
- Urgency or fear. “Your account will be blocked today”, “pay the invoice within an hour”.
- A sender address that is almost right. One letter changed, a different domain, or a free mail service instead of the company domain.
- Links that do not match. Hover over a link before clicking — the real address appears at the bottom of the window.
- Unexpected attachments, especially archives, documents asking to “enable content” and files with double extensions.
- Requests to change bank details or to make an urgent transfer, even if they seem to come from a director or a partner.
- Login pages reached from an email. Open important services yourself, from a bookmark.
- Something just feels off — unusual tone, mistakes, a message you did not expect.
What to do if you are unsure
- Do not click and do not reply.
- Check by calling the sender on a number you already know — not one from the message.
- Report the message to your IT team so it can be blocked for everyone.
- If you already entered a password, change it immediately and tell IT — speed matters.
What the company should do
Technology and people work together. Configure SPF, DKIM and DMARC for your domain, enable email filtering and attachment sandboxing, turn on multi-factor authentication so a stolen password alone is not enough, and run short, regular awareness trainings with realistic phishing simulations.
A team that knows the signs and is not afraid to report a mistake is the best phishing filter.
CySec runs phishing simulations and practical security awareness trainings for employees, and configures email protection for your domain.
Frequently asked questions
What should I do if I clicked a phishing link?
Do not panic and do not hide it. Disconnect from the network if a file was opened, tell IT immediately and change the password of any account you entered — from another device.
Can antivirus or email filters stop all phishing?
No. They stop most, but well-prepared messages and links to legitimate cloud services can still get through. Trained employees and MFA are the second line of defence.
How often should staff be trained?
Short sessions two to four times a year work better than one long training. Realistic phishing simulations show who needs extra help.
Are messengers safer than email?
Not necessarily. Phishing in WhatsApp, Telegram and SMS is growing because people trust them more. The same rules apply: verify unexpected requests through another channel.