Email impersonation exposure report - Oak Ridge Title (fictional sample)
Checked 2026-11-11 · Prepared by James Musiitwa, CISSP ยท Pecan Cyber
oakridgetitle.example
@oakridgetitle.example is being watched but not protected: spoofed mail can still get delivered.
DMARC is set to monitor only. A fake email from accounts@oakridgetitle.example can still land in inboxes, and you only find out from a report afterwards, if anyone reads it.
| Priority | Issue | Fix |
|---|---|---|
| CRITICAL | DMARC is monitor-only (p=none) Spoofed mail is reported but can still be delivered. This is the most common gap. | Review the aggregate reports, make sure every real sender passes, then move to p=quarantine and finally p=reject. |
| MEDIUM | No DMARC reporting (rua) Without reports you can't see who is sending as you or safely tighten the policy. | Add rua=mailto:<a mailbox or DMARC reporting service>. |
| MEDIUM | Weak DKIM key (google: ~1024-bit RSA) Keys under 2048 bits are below current guidance and are within reach of well-funded attackers. | Rotate selector 'google' to a 2048-bit key. |
| LOW | SPF soft-fails (~all) Fine when DMARC is enforced. On its own, ~all only marks spoofed mail as suspicious. | Keep it once DMARC is at p=reject, or move to '-all' when you're sure every sender is listed. |
| LOW | No MTA-STS Mail sent to you can be downgraded to unencrypted delivery by an attacker on the network path. | Publish an MTA-STS policy (a _mta-sts TXT record and a policy file over HTTPS), starting in 'testing' mode. |
| LOW | No TLS reporting (TLS-RPT) You won't hear about failed encrypted deliveries to your domain. | Publish a _smtp._tls TXT record 'v=TLSRPTv1; rua=mailto:<a mailbox you monitor or a reporting service>'. |
Why this matters
Business email compromise (fake invoices, payment-change requests, CEO impersonation) cost US victims $3.05 billion in 2025 across 24,768 complaints to the FBI. That's an average reported loss of about $122,981 per complaint (FBI IC3 2025 Internet Crime Report). DMARC at p=reject is the control that stops criminals from sending mail as your exact domain.
This report reads public DNS records only. It doesn't test look-alike domains, compromised mailboxes or your mail filtering, which need a fuller review.