DMARC shuts down exact-domain impersonation. (Image: 123RF) Ask most South African executives about their security posture and they’ll walk you through firewalls, patch cycles, endpoint coverage. Ask what their DMARC policy is set to, and the room usually goes quiet. A surprising number don’t have one at all – and until recently, that was a technical gap. It isn’t anymore. It’s a regulatory one.Section 19 of POPIA (condition seven, security safeguards, for those keeping score) requires a responsible party to secure the integrity and confidentiality of personal information through appropriate, reasonable technical and organisational measures: a continuing process of identifying reasonably foreseeable risks, establishing safeguards against them, regularly verifying that those safeguards are effectively implemented, and updating them as new risks emerge – not a box ticked once. Crucially, section 19(3) also requires “due regard to generally accepted information security practices and procedures”. POPIA doesn’t name a single technology. It borrows its definition of reasonable from whatever the industry has settled on – and on e-mail authentication, the industry has settled hard and fast.Google, Yahoo and Microsoft now require SPF, DKIM and a published DMARC record from anyone pushing bulk mail – 5 000 messages a day or more – into their consumer platforms, with Microsoft’s requirements taking effect for Outlook.com, Hotmail and Live addresses in May 2025. In May 2026, the IETF went further, publishing RFC 9989, with RFC 9990 and RFC 9991 covering aggregate and failure reporting. Together they obsolete RFC 7489, the informational specification that had carried DMARC since 2015, and place the protocol on the IETF Standards Track for the first time, as a proposed standard. What used to be “nice to have if you get to it” is now written into the specification itself. Try explaining to a regulator, with a straight face, why you hadn’t got round to a three-DNS-record fix that the internet’s own standards body now treats as baseline hygiene.Here’s why I think this deserves board attention rather than an IT ticket: without an enforcing DMARC policy, mail that appears to come from your real domain – not a clumsy imitation, the genuine article – stands a far better chance of reaching an inbox. That’s the launchpad for business e-mail compromise: the fake banking-details change, the fraudulent invoice, the “please confirm your credentials” message aimed at your own staff. What gets harvested in a successful run – banking details, ID numbers, client records – is exactly the personal information section 19 exists to protect. And it’s your customers and suppliers who get burned, using a domain they trusted because it was yours.I won’t oversell it. DMARC doesn’t stop display-name spoofing or a genuinely compromised mailbox, and on its own it doesn’t catch cleverly-spelled lookalike domains either. That last one is a related problem with its own answer: Libraesva LetsDMARC, which Cyberwin distributes in South Africa, pairs its DMARC reporting with Domain Guardian, which detects and tracks lookalike domains registered against your brand before anyone gets to weaponise them. What DMARC itself does reliably is shut down exact-domain impersonation and shows you, through its reporting, exactly who has been sending mail as you. For the cost, that is hard to argue with.Then there’s the part POPIA doesn’t let you quietly forget about. Section 22 requires notifying the Regulator and affected data subjects as soon as reasonably possible after discovery, where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person – no fixed 72-hour countdown; that’s a GDPR import, not a POPIA rule. But the Regulator’s own recent conduct suggests the bar for “compromise” sits lower than most boards assume. Its enforcement notice against Central Johannesburg TVET College on 22 May 2026 dealt with nothing more dramatic than employees’ personal credential verification reports being mistakenly attached to an internal e-mail about finance policies and sent to staff who had no business seeing them – and still found contraventions of sections seven, 15, 19 and 22. If an accident inside your own walls draws that response, a deliberate external impersonation of your domain is not going to be waved through.The money is real too, though it is worth being precise about where it comes from. POPIA runs two separate tracks. Administrative fines are imposed by infringement notice, without a criminal conviction, and are capped at R10 million under section 109. The criminal penalties sit in section 107, which sets no rand figure of its own but carries imprisonment of up to 10 years for the more serious offences – among them failing to comply with an enforcement notice. The Regulator’s first administrative fine under POPIA was the R5 million issued against the Department of Justice and Constitutional Development in 2023, and the detail that matters is what it was for: not the 2021 ransomware breach itself, but the department’s failure to comply with the enforcement notice that followed it. The department has taken the matter on judicial review, and I am not aware of a reported judgment. The lesson for boards is not the number. It is that the expensive step was ignoring the Regulator, not being breached.None of this requires a project plan. Inventory what actually sends mail on your behalf – your mail platform, your CRM, your invoicing tool, that scanner in the corner that e-mails PDFs – and get SPF and DKIM right for each. This is where most rollouts quietly stall: SPF permits only 10 DNS lookups, and a mid-sized organisation running a handful of cloud services breaks that ceiling without anyone noticing. LetsDMARC flattens the record automatically, which removes the single most common reason a DMARC deployment stops working a month after it was signed off.Then publish DMARC at p=none with reporting switched on, and actually read what comes back for a month or so; that’s the phase that turns up the senders nobody remembers signing up for. Raw DMARC reports arrive as XML, and nobody reads XML twice. LetsDMARC aggregates them into a dashboard showing, sender by sender, what is passing and what is failing, with forensic detail on the failures and a guided path through its observe, monitor and enforce stages. From there it is a matter of tightening to p=quarantine, then p=reject – including on the parked and legacy domains nobody thinks about, which is exactly why attackers prefer them. On that last point licensing matters more than it should: LetsDMARC is licensed per organisation rather than per domain, so the dormant domains you would otherwise leave exposed on cost grounds cost you nothing to cover.Then keep the paper trail. Section 19 asks you to verify that your safeguards are effectively implemented and to keep updating them. DMARC reporting produces exactly that evidence as a by-product – dated, continuous and specific to your domains. The control answers the threat; the record is what answers the Regulator.If you don’t know what your domain currently publishes, that’s a five-minute lookup – and usually the first time DMARC comes up in a boardroom as anything other than an IT footnote. Cyberwin’s advisory team runs a short readiness read-out – sender inventory, current posture, a prioritised path to enforcement – mapped straight to section 19, if you’d rather start there.William Despard is with Advisory Services at Cyberwin, a South African cyber security distributor running an advisory practice alongside its vendor portfolio, which includes the Libraesva e-mail-security platform, now part of LibraCyber.Disclosure: this press release is sponsored by LibraCyber. Cyberwin distributes Libraesva LetsDMARC in South Africa. The regulatory analysis, and the limits set out above on what DMARC can and cannot do, are the author’s own.