Valimail Expert & DMARC Email Authentication Consultant

What is Valimail?

Valimail is an email authentication platform. It covers the four records that decide whether a receiving mail server believes a message really came from your domain: SPF, DKIM, DMARC and BIMI. Each does a different job. SPF is a DNS record listing the servers permitted to send mail for your domain, so a receiver can check the connecting IP address against your published list. DKIM attaches a cryptographic signature to the message and publishes the matching public key in DNS, so a receiver can verify that the signed content was not altered and that someone holding your private key signed it. DMARC is the record that makes the other two mean something: it requires the passing result to align with the domain the human actually sees in the From header, it states what receivers should do when nothing aligns, and it requests aggregate reports on all mail claiming to be yours. Without alignment, an attacker can pass SPF for a domain they own while still printing yours in the From line.

Valimail's long-standing differentiator is automated enforcement. The normal DMARC failure mode is not technical ignorance, it is maintenance. Every legitimate service that sends mail as your domain, and there are always more of them than anyone expects, needs correct SPF or DKIM before the policy can tighten, and the traditional answer is an administrator hand-maintaining DNS records for each one. That approach collides with the SPF ten DNS lookup limit: an SPF record is only allowed to trigger ten DNS lookups during evaluation, and every include for a marketing platform, a CRM, a ticketing system, a payroll provider or an invoicing service consumes part of that budget. Exceed it and the record returns a permanent error, at which point SPF fails for everyone, including your own mail. Valimail automates the authentication of sending services instead, which is what makes reaching a policy of reject realistic and, more importantly, what keeps it working when the marketing team signs up for the next platform.

The policy journey itself is short to describe and long to complete. You start at p=none, which changes nothing about delivery and simply turns on reporting. You move to p=quarantine, where unaligned mail lands in junk. You finish at p=reject, where receivers refuse it outright. Only that last state actually stops exact-domain spoofing, and the whole industry problem is that a large share of published DMARC records never leave the first one. Two details get missed along the way. The first is the percentage tag, which lets you apply the policy to a fraction of mail while you build confidence rather than flipping the entire estate in one change. The second is the subdomain policy, set with the sp= tag: attackers routinely spoof a subdomain nobody sends from, so an organisation that reaches reject on the parent domain while leaving subdomains permissive has left the easier target open.

BIMI is the visible payoff and the reason many boards fund the work. It lets your verified logo appear beside your mail in supporting clients, but it has hard prerequisites: your domain must already be at DMARC enforcement, the logo must be in the specific SVG profile BIMI accepts and published at a URL referenced by a BIMI DNS record, and the major mailbox providers additionally require a Verified Mark Certificate, issued by a certificate authority against a registered trademark. The trademark registration is usually the slow part rather than the DNS work. Valimail also publishes free public tools, including a DKIM checker and a BIMI logo validator, which are worth running before you commission artwork or open a project.

One current fact a buyer needs before an evaluation: Valimail has been acquired by DigiCert, announced on Valimail's own blog. Say it plainly, because who owns a platform is part of a multi-year commitment. It is also more than corporate trivia here: DigiCert is a certificate authority and issues the Verified Mark Certificates that BIMI requires, so email authentication and the mark certificate now sit inside the same group. What I will not do is speculate about roadmap, pricing or packaging changes flowing from the acquisition, because that is not something I can evidence. If those questions bear on your decision, put them to the vendor and get the answers into the contract.

What DMARC does not do, stated up front rather than in the small print. DMARC protects only the domains you own, and it stops only exact-domain spoofing. It does nothing about a lookalike domain that swaps a letter or adds a hyphen, because that domain is not yours and the attacker can publish perfectly valid SPF, DKIM and DMARC records for it. It does nothing about display-name spoofing, where the visible sender name reads like your finance director while the actual address is a free webmail account. It does nothing about a genuinely compromised mailbox, because that mail is authentic by every measure the protocol checks. Email authentication is necessary and it is not sufficient. It sits alongside a secure email gateway, impersonation and lookalike domain controls, attachment and URL inspection, and user reporting, rather than replacing any of them. Anyone selling DMARC as the end of phishing is selling you something.

Why Valimail for UAE Organisations?

Business email compromise and invoice fraud sit among the most damaging attack types against UAE and GCC organisations, and the reason is commercial rather than technical: a fraudulent payment instruction that looks like it came from a supplier or a director moves real money in a single transaction, with none of the noise a ransomware event produces. Impersonation of banks and government entities is a live regional problem too, which makes an unprotected domain a liability to the public as well as to the organisation that owns it. Exact-domain spoofing is the cheapest version of that attack, and DMARC at enforcement is the only control that removes it outright. Everything else in the stack is detection and probability. This one is arithmetic: if the policy says reject and nothing aligns, the message does not arrive.

The regulatory framing in this market points the same way. The NESA information assurance standards expect email protection controls together with the monitoring to show they work, and the CBUAE requirements push regulated financial institutions towards demonstrable controls against customer-facing fraud and impersonation, which is precisely what an unauthenticated banking domain enables. DESC sets comparable expectations for Dubai government entities and their suppliers, and the data protection regimes in ADGM and DIFC, alongside the federal PDPL, rest on applying appropriate technical measures. An assessor reading that phrase against a domain still sitting at p=none, three years after the record was published, is entitled to ask what the measure actually is. A DMARC record at monitoring is evidence of a project, not of a control.

There is also a plain commercial driver that has nothing to do with regulators. The Google and Yahoo bulk sender rules made DMARC effectively mandatory for anyone sending at volume: bulk senders must authenticate with both SPF and DKIM, publish a DMARC record, keep spam complaint rates low, and support one-click unsubscribe. Organisations that ignored this found marketing and transactional mail throttled or junked, which turns email authentication from a security ticket into a revenue conversation very quickly. The practical UAE wrinkle is estate sprawl: regional groups tend to hold many domains and many more subdomains across brands, free zones and acquired entities, most of which send nothing and are therefore free spoofing material until a policy covers them. That inventory work is the honest first deliverable on almost every engagement. For the wider picture of how authentication fits with gateway and impersonation controls, see my email security services.