Email Defense

Email is the primary attack vector for impersonation, BEC, and phishing campaigns targeting institutional brands. Email Defense is VouchCore's foundational capability.

The Three Email Authentication Protocols

SPF (Sender Policy Framework)

SPF defines which mail servers are authorized to send email on behalf of your domain. A properly configured SPF record with a hardfail (-all) mechanism rejects mail from unauthorized sources. A softfail (~all) allows unauthorized mail through — marking it as suspicious but not blocking it.

The consequence: Without SPF enforcement, any server on the internet can send email that claims to be from your domain.

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to outbound email, allowing receiving servers to verify that the message actually originated from your infrastructure. Because DKIM requires active mail-flow to verify, VouchCore's passive DNS scan identifies selector presence but flags active verification as a recommended action.

The consequence: Without DKIM, spoofed messages cannot be distinguished from legitimate ones at the cryptographic level.

DMARC (Domain-based Message Authentication)

DMARC is the enforcement layer that ties SPF and DKIM together. A DMARC policy of reject (p=reject) instructs receiving mail servers to block any message that fails SPF or DKIM alignment. Without DMARC, spoofed messages reach inboxes regardless of SPF and DKIM state.

The consequence: A DMARC policy of none means your domain has no email fraud enforcement — spoofed messages will be delivered.

DMARC RUA Reporting

VouchCore ingests DMARC aggregate (RUA) reports when configured, providing authoritative visibility into actual mail-flow patterns — who is sending on behalf of your domain, how many messages are failing authentication, and where the failures originate. Configuring DMARC RUA reporting to VouchCore's aggregation endpoint unlocks the highest-fidelity posture analysis.