Email remains the most exploited vulnerability in data protection failures that lead to GDPR penalties. The €400M+ in fines handed down since 2020 for email-related breaches share common patterns: organizations failed to implement basic authentication controls, monitor unauthorized senders, or detect compromise before mass data exfiltration occurred.

Coupang’s 2024 penalty exemplifies this pattern. The South Korean retailer faced a €15M fine not because encryption failed, but because inadequate access controls and monitoring allowed unauthorized parties to access customer data through compromised email channels. The breach wasn’t sophisticated it exploited authentication gaps that DMARC, sender validation, and unauthorized access detection could have surfaced.

GDPR does not mandate DMARC by name. Articles 32 and 5(1)(f) require “appropriate technical and organisational measures” and processing security “appropriate to the risk.” Email authentication controls support those objectives. When enforcement authorities investigate a breach where phishing, spoofing, or unauthorized sender access contributed to data exposure, they evaluate whether the organization implemented reasonable measures to prevent it.

This brief identifies seven email security gaps that appear in GDPR penalty decisions, connects each to preventable authentication failures, and explains how organizations can close them.

I. Gap 1: No Domain-Level Authentication → Undetected Spoofing

7 GDPR Email Security Gaps Triggering €400M+ Fines

The Compliance Failure:
Organizations publish no SPF record, no DMARC policy, or leave DMARC at p=none indefinitely. Threat actors spoof internal domains to target employees, partners, or customers. When the spoofed email leads to credential theft or data exfiltration, regulators ask: “Did you implement measures to prevent domain impersonation?”

What Can Go Wrong:
SPF can fail silently when DNS lookups time out (temperror) or when the record exceeds 10 DNS lookups (permerror). DMARC can pass authentication but fail alignment when the envelope sender differs from the header From address. Authentication passing does not guarantee inbox placement, and authentication failing does not always mean immediate rejection—but lack of enforcement removes a critical detective control.

Prevention:
Start DMARC monitoring, move toward p=quarantine or p=reject enforcement, and document the timeline. DMARC enforcement does not guarantee inbox placement, but when honored by receiving servers, p=reject instructs them to refuse unauthenticated messages during SMTP delivery.

Organizations subject to GDPR commonly implement DMARC enforcement as part of their email security program. Use Skysnag Protect to identify legitimate senders, detect unauthorized sources, and stage enforcement by subdomain, business unit, and sender group.

GDPR Article 32 Connection:
Article 32 requires “a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures.” A domain with no enforcement has no mechanism to block or even detect spoofing in real time.

II. Gap 2: Unmonitored Third-Party Senders → Shadow IT Email

Three-layer email architecture showing approved corporate senders, shadow IT services, and threat vectors from unauthorized sources

The Compliance Failure:
Marketing platforms, CRM tools, support ticketing systems, and SaaS applications send email on behalf of the organization. IT does not maintain an inventory. Employees authorize tools without IT review. Rogue or compromised services send spoofed messages, and the organization only discovers the issue after a breach.

What Can Go Wrong:
Third-party senders that do not publish DKIM signatures or fail SPF alignment will fail DMARC even when the service is legitimate. If the organization enforces DMARC at p=reject, legitimate mail from unvetted services may be refused. If the organization does not enforce, attackers can spoof using services the organization never authorized.

Prevention:
Maintain a sender inventory. Require IT approval before authorizing any service to send on behalf of corporate domains. Use DMARC aggregate reports to discover unauthorized senders. Skysnag Protect surfaces every source sending on your behalf and flags sources not in your approved inventory.

GDPR Article 28 Connection:
Article 28 requires organizations to use processors that “provide sufficient guarantees” and implement “appropriate technical measures.” If IT cannot identify which processors send email, they cannot evaluate those guarantees.

III. Gap 3: Static DMARC Record With No Report Collection → Compliance Theater

The Compliance Failure:
The organization publishes a DMARC record that includes rua=mailto:[email protected], but no one monitors the mailbox. Reports pile up unread. The organization cannot identify new threats, unauthorized senders, or authentication failures. When a breach occurs, the organization cannot demonstrate that monitoring was active.

What Can Go Wrong:
DMARC aggregate reports arrive in XML format from hundreds of sources daily. Without automated parsing, report data is unusable. DNS delivery failures, mailbox quota issues, and misrouting can cause reports to stop arriving silently. A static record with no monitoring provides no security benefit.

Prevention:
Use managed DMARC monitoring. In a Skysnag deployment, the reporting destination is generated and maintained by Skysnag. Reports are parsed, normalized, and surfaced in a dashboard that shows sender compliance, authentication results, and new sources in real time.

A traditional static record such as:

v=DMARC1; p=none; rua=mailto:[email protected]

can work, but only if reports are actively received, parsed, analyzed, and acted on. The better approach is to start DMARC monitoring through Skysnag and get a managed record generated for your domain.

GDPR Article 32 Connection:
Article 32 requires “measures to ensure ongoing confidentiality, integrity, availability and resilience.” A record with no monitoring does not provide ongoing visibility.

IV. Gap 4: No Enforcement Policy → Unauthorized Senders Pass Through

The Compliance Failure:
The organization publishes DMARC at p=none and leaves it there. DMARC reports show failing sources, but no enforcement action is taken. Threat actors discover the lack of enforcement and spoof the domain at scale. When phishing leads to a data breach, enforcement authorities evaluate whether the organization implemented reasonable blocking measures.

What Can Go Wrong:
When honored by the receiving server, p=reject instructs them to refuse unauthenticated messages during SMTP delivery and the message should not reach the inbox or spam folder. However, enforcement depends on the receiving server honoring the policy. Some forwarders, mailing lists, and misconfigured receivers do not. DMARC enforcement does not guarantee rejection everywhere, but it significantly reduces spoofing success rates.

Organizations commonly remain at p=none because they fear blocking legitimate mail. That fear is valid. Avoid relying on percentage-based rollout (pct=) as the primary strategy. Current DMARC-aware programs should stage enforcement by domain, subdomain, sender group, and business function.

Prevention:
Use DMARC aggregate reports to identify all legitimate senders. Verify SPF and DKIM for each. Test enforcement on low-risk subdomains first. Move production domains to p=quarantine, then p=reject as sender compliance improves. Use Skysnag Protect to track sender authentication status and stage enforcement safely.

GDPR Article 5(1)(f) Connection:
Article 5(1)(f) requires “appropriate security” to protect against “unauthorised or unlawful processing.” A domain that does not instruct receivers to block unauthorized use provides weaker protection.

V. Gap 5: No DKIM Rotation → Key Compromise Goes Undetected

The Compliance Failure:
The organization published a DKIM key five years ago and never rotated it. A developer leaves the company with access to the private key. A server is decommissioned without key revocation. A configuration backup containing the key is stored in an unsecured S3 bucket. Threat actors find the key and sign malicious messages that pass DMARC.

What Can Go Wrong:
DKIM signatures can fail when the key is rotated but DNS is not updated, when the message body is modified in transit, or when signature headers are stripped by forwarders. DKIM passing does not guarantee DMARC passing—alignment is also required. However, a valid DKIM signature from a compromised key can bypass DMARC enforcement entirely.

Prevention:
Rotate DKIM keys annually. Revoke old keys immediately when servers are decommissioned or personnel with key access leave. Monitor DKIM signing consistency through DMARC reports. Use Skysnag Protect to track DKIM usage across senders and detect signatures from unexpected selectors.

GDPR Article 32(1)(d) Connection:
Article 32(1)(d) requires measures “for ensuring the ongoing confidentiality, integrity, availability and resilience of processing systems.” A static key that is never rotated increases compromise risk over time.

VI. Gap 6: No Visibility Into Email Source Infrastructure → Undetected Compromise

The Compliance Failure:
The organization knows it sends email, but IT cannot list every IP address, domain, or service that sends on its behalf. When DMARC reports show a new source, no one knows whether it is legitimate, rogue, or compromised. Days or weeks pass before investigation begins.

What Can Go Wrong:
DMARC aggregate reports show the envelope sender (used for SPF), the header From domain (used for DMARC alignment), and the DKIM signing domain. If any of those do not match expected values, authentication may pass but spoofing is still possible. For example, a legitimate service might pass SPF but fail DMARC alignment because the header From domain differs. Investigation is harder because monitoring shows authentication results, but the domain is not instructing receivers to block unauthenticated use.

Prevention:
Maintain a complete inventory of authorized email infrastructure: IP addresses, sending services, SPF includes, DKIM selectors, and DMARC alignment modes. Compare DMARC reports to the inventory daily. Use Skysnag Protect to automate sender discovery, flag new sources, and correlate authentication results to known infrastructure.

GDPR Article 30 Connection:
Article 30 requires organizations to “maintain a record of processing activities.” Email is a processing activity. If IT cannot list the systems and services that send email, the record is incomplete.

VII. Gap 7: No Evidence of Monitoring → Inability to Demonstrate Compliance

The Compliance Failure:
The organization claims it monitors email security, but has no logs, no incident response records, no evidence of authentication review, and no documentation of enforcement decisions. When a breach occurs, enforcement authorities ask for evidence of proactive monitoring. The organization cannot provide it.

What Can Go Wrong:
GDPR penalties scale based on intent, negligence, and remediation responsiveness. Organizations that demonstrate proactive monitoring, evidence-based enforcement, and documented incident response receive more favorable treatment. Organizations that cannot demonstrate any of those face higher penalties.

Prevention:
Log DMARC reports, authentication decisions, sender changes, and enforcement actions. Retain logs according to data protection policy (avoid indefinite retention). Document enforcement staging decisions. Use Skysnag Comply to maintain evidence of email authentication controls across domains and senders, with audit trails for compliance review.

GDPR Article 5(2) and Article 24 Connection:
Article 5(2) requires organizations to “be able to demonstrate compliance.” Article 24 requires “appropriate technical and organisational measures” and the “ability to demonstrate” them. Email authentication monitoring provides that evidence.

VIII. What GDPR Actually Requires (and Doesn’t Require)

GDPR does not mandate DMARC by name. It does not specify SPF, DKIM, BIMI, or any particular email authentication protocol. What it does require:

  • Article 32: “Appropriate technical and organisational measures to ensure a level of security appropriate to the risk.”
  • Article 5(1)(f): Processing must ensure “appropriate security” against “unauthorised or unlawful processing.”
  • Article 24: The controller “shall implement appropriate technical and organisational measures” and “be able to demonstrate that processing is performed in accordance with this Regulation.”

Email authentication controls support those objectives. When enforcement authorities investigate a breach where spoofing, unauthorized sender access, or email-based data exfiltration contributed to harm, they evaluate whether the organization implemented reasonable preventive measures. A domain with no DMARC enforcement, no sender monitoring, and no authentication logging presents weaker evidence of reasonable measures.

Organizations that can demonstrate proactive monitoring, staged enforcement, sender inventory maintenance, and documented incident response show stronger compliance posture. Use Skysnag Comply to maintain that evidence across domains, business units, and third-party senders.

IX. Key Takeaways

  • GDPR does not mandate DMARC, but email authentication controls support Articles 32, 5(1)(f), and 24 security objectives.
  • €400M+ in GDPR fines involved breaches where email security gaps contributed to unauthorized access or data exfiltration.
  • The seven most common email security gaps that appear in GDPR penalty decisions are: (1) no domain authentication, (2) unmonitored third-party senders, (3) static DMARC with no report collection, (4) no enforcement policy, (5) no DKIM rotation, (6) no visibility into email infrastructure, and (7) no evidence of monitoring.
  • Authentication passing does not guarantee inbox placement. Authentication failing does not always mean rejection. But enforcement provides a measurable control that regulators can evaluate.
  • Organizations that demonstrate proactive monitoring, staged enforcement, and documented incident response receive more favorable treatment during breach investigations.
  • Use Skysnag Protect to identify legitimate senders, detect unauthorized sources, and stage DMARC enforcement by subdomain and sender group.
  • Use Skysnag Comply to maintain evidence of email authentication controls, sender inventory, and enforcement decisions for compliance review.

Start DMARC monitoring with Skysnag and get your free DMARC record: