Home · Whitepapers

Whitepapers

Standards that force authentication—and what still sits outside DMARC.

22 October 2026

These notes are written for security, compliance, and mail operators who already know SPF and DKIM exist. They connect receiver rules and control frameworks to the publish path on Sender Identity, and—where DMARC stops—to Finmail’s isolated executive mailbox. Also listed under Guides → Compliance & Protocols.

• Google & Yahoo bulk sender requirements: complete 2026 audit checklistSPF, DKIM, DMARC, one-click unsubscribe, and spam-rate thresholds for ≥5,000 messages/day.
• PCI DSS 4.0 Requirement 5.4.1: anti-phishing & DMARC for payment domainsHow domain authentication supports phishing-resistant processes for payment brands.
• Defending against BEC: from domain protocols to executive private mailWhy DMARC is necessary and still insufficient for CFO and CEO inboxes—and when Finmail fits.