Which combination best describes steps to secure email against phishing and spoofing?

Which combination best describes steps to secure email against phishing and spoofing?

• A. Enable SPF only.
• B. Rely on user vigilance without technology.
• C. Enable SPF, DKIM, and DMARC; deploy anti-malware; train users; verify domains; avoid clicking links; and require MFA for email accounts.
• D. Disable external email access.

Answer: (C)

A layered approach to email security combines solid domain authentication with practical protection and user practices. Start with authentication: SPF checks that the sending server is authorized to send on behalf of your domain; DKIM adds a cryptographic signature that verifies the message content and origin hasn’t been tampered with; DMARC ties SPF and DKIM together and enforces what to do with messages that fail authentication, such as quarantine or reject, while also providing reporting. Together, these protocols drastically reduce the chance that spoofed emails reach users or bypass defenses. Beyond authentication, add anti-malware scanning to catch malicious attachments and links, and train users to recognize phishing cues and verify domains before acting. Encourage verification of domains—for example, checking that the domain in a link matches the legitimate site—and avoid clicking on links in unsolicited messages. Strengthen access security by requiring multi-factor authentication for email accounts, so that even if credentials are compromised, access is still protected. Enabling SPF alone is insufficient since it doesn’t cover DKIM/DMARC; relying on user vigilance alone misses threats that technical controls would block; and completely disabling external email access is impractical for most environments.

A layered approach to email security combines solid domain authentication with practical protection and user practices. Start with authentication: SPF checks that the sending server is authorized to send on behalf of your domain; DKIM adds a cryptographic signature that verifies the message content and origin hasn’t been tampered with; DMARC ties SPF and DKIM together and enforces what to do with messages that fail authentication, such as quarantine or reject, while also providing reporting. Together, these protocols drastically reduce the chance that spoofed emails reach users or bypass defenses.

Beyond authentication, add anti-malware scanning to catch malicious attachments and links, and train users to recognize phishing cues and verify domains before acting. Encourage verification of domains—for example, checking that the domain in a link matches the legitimate site—and avoid clicking on links in unsolicited messages. Strengthen access security by requiring multi-factor authentication for email accounts, so that even if credentials are compromised, access is still protected.

Enabling SPF alone is insufficient since it doesn’t cover DKIM/DMARC; relying on user vigilance alone misses threats that technical controls would block; and completely disabling external email access is impractical for most environments.