Phishing remains the leading initial access vector in breaches. Domain owners also bear brand damage when their name is spoofed.
The metrics that matter#
- Authentication pass rate: share of mail passing SPF, DKIM, and DMARC alignment. Healthy: 99% or higher.
- Spam complaint rate: Gmail enforces at 0.3%; stay under 0.1%.
- Hard bounce rate: under 2%; above 5% triggers platform reviews.
- Inbox placement: above 90% across major providers via seed tests.
- Engagement: click and reply rates by segment; opens are unreliable after Mail Privacy Protection.
Where to read them#
- Google Postmaster Tools for Gmail domain reputation, spam rate, and authentication.
- Microsoft SNDS and JMRP for Outlook.com IP reputation and complaints.
- Your ESP's delivery and bounce reports.
- DMARC aggregate reports for authentication by source.
Improving the numbers#
- Enforce DMARC p=reject so exact-domain spoofing fails.
- Register lookalike domains or monitor them for registration.
- Enable link rewriting and attachment sandboxing at the gateway.
- Run quarterly simulations and make reporting a one-click action.
- Apply BIMI so users learn what authentic mail looks like.
Frequently asked questions#
Does DMARC stop all phishing?
It stops exact-domain spoofing. Lookalike domains and display-name spoofing require additional controls.