An organisation can have properly configured email authentication and still face someone impersonating its CEO, a trusted supplier or the brand itself.
Authentication helps a receiving system decide whether a message is allowed to use a domain. It does nothing to stop an attacker registering a lookalike domain, compromising a legitimate mailbox or crafting a request convincing enough to make an employee act.
An authenticated message, in other words, is not automatically a trusted identity.
Losses show why impersonation matters
The US Federal Trade Commission reported more than $3.5 billion in reported losses from imposter scams in 2025, across over a million complaints. The figures are US-specific rather than representative of the Gulf, but they show the scale of a threat built on impersonating trusted people and organisations.
For security teams, the question is moving beyond “did this email pass authentication?” It also has to be “can we trust the identity behind it?”
Authentication is the floor, not the ceiling
SPF identifies the mail servers authorised to send for a domain. DKIM adds a cryptographic signature that a receiving system can validate. DMARC uses that authentication and domain alignment to tell receiving servers what to do with anything that fails.
Together they’re a solid foundation. They just weren’t built to catch every impersonation scenario.
Take a supplier payment request. If an attacker registers a domain that differs from the real one by a single character or a small formatting change, that fraudulent domain can have its own correctly configured SPF, DKIM and DMARC records. The checks pass. The employee is simply talking to the wrong organisation.
Compromised mailboxes are the harder case. If an attacker takes over a real executive’s inbox, the email genuinely comes from the organisation’s own domain, through an authorised sending path. Every technical check succeeds. The problem has moved from domain security to identity and account security, and no DNS record fixes that.
Lookalikes exploit how people actually read email
Brand impersonation works partly because people recognise names faster than they inspect technical identifiers. Someone reviewing a supplier request on a phone between meetings isn’t scrutinising the sender address character by character — they’re recognising a name and acting on it.
That’s the gap between domain authenticity and brand recognition. Closing it means watching for domains that imitate a corporate brand, not just locking down your own mail servers.
A visible brand signal helps — with limits
This is where BIMI earns a place in the toolkit. Brand Indicators for Message Identification lets an eligible organisation display its logo next to authenticated emails in supported inbox environments.
To back a BIMI logo with a trademarked mark, organisations need a Verified Mark Certificate, which comes with its own DMARC-enforcement and trademark prerequisites.
None of this replaces SPF, DKIM or DMARC. BIMI is best treated as an extra signal — something that helps a recipient recognise a legitimate message, not proof that the message is safe.
DNS upkeep is the part everyone skips
Identity controls only work if someone maintains them. Switch email providers, add a marketing platform, or plug in a new SaaS tool, and you’ve likely introduced sending infrastructure your DMARC policy doesn’t know about yet.
BIMI deployments have their own operational quirks. Duplicate BIMI DNS records can cause a logo to silently fail to display, even when everything looked correct at setup. A hosted logo file or certificate resource that can’t be retrieved causes the same silent failure.
None of this is dramatic. But it’s a reminder that identity controls need ongoing validation, particularly after a change of domain, provider or application.
AI is eroding the old warning signs
Security Middle East reported in May that cybersecurity leaders across the region are already dealing with AI-generated audio and video used to impersonate executives and authorise fraudulent transactions — a shift one CISO described as moving from theoretical to “playing out in real operations.”
That changes what security awareness training needs to cover. Poor grammar and odd phrasing used to be the tell. An AI-assisted message can reference a real project, use the right terminology, and create urgency that feels completely ordinary.
The safer instinct isn’t “spot the fake” anymore. It’s “verify the request independently, every time it matters.”
Layered identity protection, not a single fix
There’s no one control that ends brand impersonation. Start with the basics — accurate SPF, DKIM and DMARC, regular review of authentication reports, monitoring for lookalike domains, and extra protection on executive accounts.
Then add independent verification for anything high-risk. A bank detail change shouldn’t be approved on the strength of an email alone. An urgent request from a senior executive is worth a two-minute call through a separate channel before it’s actioned.
Some organisations test this with controlled impersonation exercises, checking whether staff know when to pause, who to call and how to verify before acting.
Identity is the real question
SPF, DKIM and DMARC still matter — they’re not going anywhere. BIMI adds a visible signal. Domain monitoring catches lookalike infrastructure before it’s used. Account protection reduces the odds of a genuine mailbox being the source of the attack.
None of these work alone. The question worth asking isn’t whether an email passed authentication. It’s whether the identity behind it can actually be trusted — and whether anything high-risk gets checked before it’s acted on.
