The people who approve the work do not run DNS, and the explanation that persuades them is not a simpler version of the technical one. It is a different explanation, about what someone can do today and what changes if you act.
Lead with the capability, not the mechanism
Not: "We don't have a DMARC policy, which means receivers
have no instruction for messages failing SPF or DKIM
alignment."
But: "Right now anyone in the world can send an email that
arrives looking exactly like it came from our finance
team. Nothing stops it and we would not know it had
happened."The second is not dumbed down — it is more precise about the thing that matters. The first describes a configuration; the second describes what is possible.
The four questions you will be asked
| Question | The honest answer |
|---|---|
| Has this happened to us? | Without reporting, unknowable — which is itself the first finding. With reporting, a number. |
| What does it cost to fix? | Two to three weeks of work spread over a quarter or two, and possibly a vendor tier upgrade. Name the vendor. |
| What is the risk of the fix? | If done on evidence, small and staged. If done to a deadline without evidence, we reject our own invoices. |
| Does this stop phishing? | It stops mail claiming to be from our domain. It does not stop lookalike domains, display-name tricks, or a compromised mailbox. |
The fourth answer is the one that builds credibility, and the one most often fudged. Overstating the scope produces a follow-up conversation six months later about why phishing still arrives.
Analogies to avoid
- “It is like a passport for your email.” Invites “so we are safe now?”, which is exactly the misunderstanding you will spend the next year correcting.
- “It is a lock on the door.” Suggests inbound protection. This is entirely about outbound.
- Anything with a percentage of attacks stopped. Vendor marketing figures will be quoted back at you when they turn out not to hold.
A live demonstration is worth the whole deck
Send a message that appears to come from a colleague, to yourself, from a domain at p=none that you own — never the organisation’s own live domain, and never to anyone who has not agreed to it. One screenshot of the result ends the conversation about whether this is theoretical.