Email Security

Barrion checks whether your domain has DNS records in place that prevent attackers from sending emails pretending to be from you. Without these protections, anyone can forge emails that appear to come from your domain, making phishing attacks against your customers and employees far more convincing.

What Barrion Checks

Barrion evaluates three email authentication standards by performing DNS lookups against your domain.

SPF (Sender Policy Framework)

Barrion checks whether your domain has an SPF record that specifies which mail servers are authorized to send email on your behalf. It also checks whether the policy is set to reject or flag mail from unauthorized sources.

Without SPF, any mail server in the world can send email that claims to be from your domain, with no mechanism for recipients to detect the forgery.

DKIM (DomainKeys Identified Mail)

Barrion checks whether your domain has published a DKIM public key. DKIM adds a cryptographic signature to outgoing emails, allowing recipients to verify that messages were genuinely authorized by your domain and were not tampered with in transit.

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

Barrion checks whether your domain has a DMARC record and what policy it enforces. DMARC ties SPF and DKIM together and tells receiving mail servers what to do when an email fails authentication, quarantine it, reject it, or let it through.

DMARC also enables reporting, so you can receive visibility into who is sending email claiming to be from your domain.

Severity: The overall severity is based on a composite score across all three records. Missing all three is High; partial coverage is Medium.

What to Do

Email security records are configured through your domain's DNS provider and email service provider (Google Workspace, Microsoft 365, etc.). Share failing findings with your IT team or whoever manages your domain's DNS. Each finding in Barrion describes which specific record is missing or misconfigured.