An impersonation attack is a form of social engineering in which a bad actor uses electronic communications to “spoof” or impersonate the identity of a trusted colleague. The most common form that impersonation attacks take is in conjunction with phishing emails, which pretend to come from a trusted person or brand in order to trick the recipient into giving cyber criminals money or sensitive information.

One subset of the phishing attack that is rising in importance is spear phishing. A spear phishing attack targets specific individuals inside a company or other organization in a sophisticated, often multi-step bid to achieve a high value objective such as a wire transfer for a large amount of money or the W-2 information for the company’s employees.

A critical component of a successful spear phishing campaign is that it appears to come from a known individual inside the same organization. One reason spear phishing attacks are successful is that the email address in the message’s From field will match the expected address for the spoofed employee. Were this email address different from that of the actual spoofed employee, the likelihood of success would drop considerably.

Introducing Email Authentication as a Service

That is where authenticated email comes in. Email authentication makes it possible for the owner of a domain to monitor and control who is trying to send mail using that domain name. Only approved senders are able to get messages through to mailboxes, with receiving mailboxes marking those from unauthorized senders automatically as spam or dropping them altogether, at the domain owner’s option.

This feat is accomplished using the open standard DMARC (Domain-based Message Authentication, Reporting & Conformity), which is honored by all major email service providers (ESPs), accounting for 2.7 billion mailboxes worldwide. Unfortunately DMARC is a complex and error-prone protocol to implement, and as your business evolves, your DMARC records need to stay current or critical email may not get to its destination.

ValiMail addresses this problem through Email Authentication as a Service™. The ValMail cloud service automatically configures and monitors DMARC records for your domains, along with the SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) records it builds on.

The intuitive ValiMail console gives you visibility on the volume and nature of mail sent using your domain names, including phishing email, and lets you manage and update your approved senders, cryptographic keys, and other settings with point-and-click ease. It provides correctly configured, error-free, email authentication for as many domain names as you like, protecting your employees and your customers from impersonation attacks.