How Email Security Works: From SPF, DKIM and DMARC to Link Rewriting, Sandboxes and Clawback

Email is still the most common way into companies, and email security is a stack of controls that each answer a different question. Interviewers like to ask "our DMARC is at reject, so why do we still get phished?" because the answer shows whether you know what each layer actually checks.

Layer 1: who sent it

SPF lists which servers may send for a domain, DKIM signs messages with the domain's key, and DMARC ties them to the visible From address and tells receivers what to do on failure. Since February 2024, Google and Yahoo have required bulk senders to use all three. Outlook.com followed for high-volume senders from May 2025, routing non-compliant mail to Junk first. Authentication is now table stakes, which is exactly why attackers authenticate their own lookalike domains. DMARC proves a message came from the domain it names, not that the domain or the message is benign.

ARC (RFC 8617, an Experimental RFC) helps when forwarding or mailing lists break SPF and DKIM: intermediaries record the authentication results they saw, and the final receiver can choose to trust them.

Layer 2: is the content harmful

Two deployment models do this work. A secure email gateway sits inline: your MX record points at it, it filters before delivery and can reject outright, but it only sees mail that passes through it, so mail between colleagues, which a compromised account will use, goes around it. An API-based product connects to Microsoft 365 or Google Workspace, sees internal and external mail, and pulls messages out after delivery, with a short window in which a message sits in the inbox. Many organisations use built-in filtering plus one of the two.

Inside either, the main techniques are:

• Reputation and behaviour models for business email compromise, which often contains no link or attachment: a first-time sender from a week-old domain, a display name matching an executive, a reply-to mismatch, a request to change bank details.
• Attachment detonation in a sandbox. Attackers respond with password-protected archives and files that wait before acting.
• Link rewriting with time-of-click checks. The link is checked again when someone clicks it, because attackers switch a harmless page to a phishing page after delivery or show the phishing page only to visitors who look like real users.

The QR-code gap

QR codes in images or attachments carry a URL that rewriting cannot touch, and the scan happens on a personal phone outside the company's controls. In January 2026 the FBI warned that a North Korean group was using QR codes in spear-phishing for exactly this reason. Products now decode QR images and treat their URLs like links, but phishing-resistant MFA is what makes the stolen password useless.

After a miss

Some phishing always gets through, so the last layers matter most. Make reporting one click, triage reports automatically, and remove every copy of a confirmed phish from every mailbox, measuring the time from first delivery to removal. Verify any change of payment details through a known phone number, never by replying. And use passkeys or security keys, which are bound to the real site and cannot be replayed from a lookalike page.

The interview answer in one breath

"DMARC proves which domain sent a message. After it, I need content and behaviour detection for BEC, sandboxing, link checks at click time, QR-code handling, fast user reporting with clawback, out-of-band payment verification and phishing-resistant MFA, and I would choose between a gateway and an API-based product based on whether I need to see internal mail."

Go deeper

The full scored answer with a what-if ladder is email security after DMARC. The authentication layer itself is covered in SPF, DKIM and DMARC, and the response side in a compromised mailbox.