Home · Whitepapers · BEC
Whitepaper · BEC
Defending against BEC: from domain protocols to executive private mail
22 October 2026
Business Email Compromise thrives on impersonation and urgency. DMARC at reject stops outsiders from forging your domain’s From header at scale. It does not stop a compromised mailbox, a look-alike domain, or an executive who negotiates high-value payments on the same inbox that receives newsletters and vendor spam.
What DMARC actually buys you
- Receivers can refuse mail that claims
@brand.examplewithout aligned SPF/DKIM. - Aggregate reports reveal shadow IT senders before you enforce.
- Customer-facing mail (receipts, resets, notices) becomes harder to spoof.
Sender Identity exists to make that path concrete: free static audit, Hosted DMARC with staged p=none → quarantine → reject, and sender inventories from reports.
Where domain protocols stop
- Look-alike domains (
brand-example.com) are not covered by your DMARC policy. - Account takeover of a real mailbox passes SPF/DKIM because the mail is genuine.
- Thread hijacking and reply-chain attacks reuse trusted context.
- Shared executive inboxes mix board materials, payroll instructions, and low-value mail in one blast radius.
Why high-isolation executive mail still matters
For CFO, CEO, and deal desks, the control objective shifts from “authenticate the brand domain” to “shrink who can see and who can send high-risk instructions.” That is a different product surface than DMARC hosting.
Finmail—operated by the same company that runs Sender Identity—provides a high-isolation mailbox for sensitive executive correspondence: separated from marketing ESPs and day-to-day collaboration suites, with a security posture aimed at confidential threads rather than bulk deliverability. Use Sender Identity so the world cannot forge your public domain; use Finmail so payment authority and privileged negotiation do not share fate with every OAuth’d SaaS that can send as the office suite.
Practical split
| Traffic | Examples | Primary control | Product |
|---|---|---|---|
| Public brand mail | billing@, support@ | DMARC reject + ESP DKIM | Sender Identity Hosted DMARC |
| Executive private mail | deal desk / CFO | Isolated mailbox, strict access | Finmail |
| Internal collaboration | day-to-day | IdP, MFA, DLP | Existing suite—hardened |
Start with the free audit on the corporate domain, enroll Hosted DMARC until reject is honest, and move high-value human conversations to a mailbox designed for isolation—not as a substitute for DMARC, but as the layer DMARC cannot be.