Email authentication is a set of technical standards — SPF, DKIM, and DMARC — that let receiving mail systems verify a message genuinely came from the domain it claims. For employers it addresses a specific, expensive problem: attackers sending mail that appears to come from your own company, to your employees, your vendors, and your customers.
A fraudulent direct deposit request that appears to come from your HR department, sent from your actual domain name, is precisely what these standards exist to stop — and they only stop it if configured, which at many employers they are not.
SPF publishes which servers are allowed to send mail for your domain. A receiving system checks whether the message arrived from one of them.
DKIM adds a cryptographic signature proving the message was not altered and genuinely originates from the domain's authorized systems.
DMARC is the policy layer that makes the first two enforceable: it tells receiving systems what to do when a message fails — deliver anyway, quarantine, or reject — and sends the domain owner reports about who is sending mail in its name.
The crucial detail is that SPF and DKIM without DMARC accomplish little, and DMARC in monitoring-only mode — where most deployments stall — accomplishes nothing against fraud. Protection begins when the policy reaches quarantine or reject.
The schemes that reach workforce functions lean on sender credibility. Exact-domain spoofing — mail forged to come from your real domain — is the strongest possible credibility, and it is entirely preventable with an enforced DMARC policy.
What the standards do not prevent is worth equal clarity:
So the standards close one route completely and leave the others to verification procedures and training. That is still an excellent trade: it removes the most convincing version of the attack and does so silently, before any employee's judgment is tested.
An enforced policy also protects outward: vendors, carriers, and employees' personal inboxes will reject forged mail claiming to be your company. That matters to employers specifically because payroll and benefits fraud against your workforce often arrives as mail pretending to be you — an open enrollment notice, a payroll alert — sent to employees' personal addresses. Your DMARC policy is what lets their mail providers drop those forgeries.
It increasingly matters for deliverability too: major mail providers now require authentication from bulk senders, so the same configuration that blocks fraud keeps legitimate HR communications out of spam folders.
The reason deployments stall in monitoring mode is fear of blocking legitimate mail — and the fear is rational, because organizations send from more places than they realize: the payroll provider, the benefits platform, the applicant tracking system, marketing tools, and the scanner in the copy room.
The path that works: turn on DMARC in monitoring mode and collect reports for a few weeks; inventory every legitimate sender the reports reveal; bring each into SPF or DKIM alignment — most workforce vendors document exactly how; then step the policy to quarantine, and finally reject.
The vendor inventory step doubles as governance: the report data is a complete list of who sends mail as your company, which is worth having entirely apart from the security benefit.
For your own domain: is DMARC published, and at what policy? A monitoring-only policy that has been "temporary" for two years is the most common finding.
For your vendors: do the payroll and benefits platforms sending mail to your employees authenticate properly, and do their messages come from a domain your staff can recognize? A vendor sending legitimate mail that looks structurally identical to phishing is training your workforce to click on anything.
Employer's Guardian helps employers close the spoofing route and build the verification practices that cover what authentication cannot through payroll services.
This article provides general educational information, not legal, tax, or insurance advice. Requirements vary by location, industry, and the data your organization handles.