Karl heads up Information Security at Exclaimer, where he’s focused on keeping data secure and ensuring compliance with standards like ISO 27001 and SOC2. With years of hands-on experience, Karl is dedicated to simplifying security processes and staying ahead of potential threats. He’s passionate about using automation and smart practices to strengthen security without adding unnecessary complexity.
When the writing proves nothing: Why email trust is now an infrastructure problem
Key takeaway
Good writing no longer tells you whether a human or a machine wrote an email.
What’s still meaningful is checked by infrastructure before anyone reads the message: SPF, DKIM, and DMARC.
Sales and outreach tools connected without IT sign-off can quietly damage the domain reputation everyone else relies on.
A governed email signature helps with brand consistency and compliance, and makes anomalies easier to spot. It isn't a security control.
I get a lot of cold sales emails. My reflex with every one is the same: scroll straight to the unsubscribe button, because that tells me it wasn't written by a person. A few months back I got an email from the CEO of the security awareness vendor we'd just moved to.
Just checking in, asking how things were going, offering to help. No unsubscribe link. Properly formatted. Came from exactly where it said it came from. I didn't think it was really him. I replied anyway, half-joking that if this was a phishing test, it was a good one. Not my finest security moment, I’ll admit. He replied again. It was really him. I do this for a living, and I couldn't tell.
What actually makes an email trustworthy?
The writing can’t tell you: plenty of AI-generated emails read perfectly well now. Sentence quality stopped being a reliable signal a while ago. People already second-guess messages: 41% of UK and US adults say they’ve questioned whether one was genuine (Exclaimer, When it Matters 2026, OnePoll, 2,000 adults)
An email signature can’t tell you either. Anyone can copy one from a real email. The checks that mean something happen underneath the words, where a human can't see them: SPF, DKIM and DMARC. SPF checks that a server is allowed to send for your domain, DKIM checks that the message wasn’t changed in transit, and DMARC tells receiving servers what to do when either check fails.
Those checks are IT decisions, and they have to happen before the message reaches anyone, because a recipient can't verify them. That's the real security work: a sending domain with a reputation that's actively managed, and authentication that passes, whatever the email looks like.
Why does this email matter more as AI floods the inbox?
Because the thing that used to signal a human, careful writing, isn't a signal anymore.
As AI-generated email becomes ordinary, what's left has to be verifiable: DMARC at enforcement, sending domains that are actively managed, and a habit across the business of confirming unusual requests through another channel.
Monitoring only logs failures and still delivers the mail. Enforcement matters because spoofed mail from your domain then gets rejected or quarantined instead of delivered. Fewer than a third of organizations (33%) have implemented DMARC, DKIM, or SPF, according to Exclaimer’s State of Business Email 2025 research of 4,009 IT professionals.
Where does email trust break down in practice?
Email trust breaks down at shadow IT. Sales and GTM teams connect email sequencing tools to do outreach, often without looping in IT because it takes twenty minutes to set up and it's just email.
The sending patterns from those tools aren't always clean. Unsubscribe handling is often patchy. And the domain reputation that the rest of the organization depends on quietly erodes because of a tool IT never knew existed.
By the time deliverability drops across the company, the damage is already sitting in the domain's reputation. There's no fast way to undo months of bad sending behavior. The fix has to sit upstream: a clear rule on what's allowed to send as your domain, and visibility into what's actually sending right now, not just what IT provisioned at onboarding. DMARC aggregate reports are a good start, because they show the sources sending mail as you, including the ones IT never approved.
What should IT leaders do about email trust?
Get DMARC to enforcement. Know every service that sends as your domain. Require IT sign-off before any tool connects to company email.
And keep the human habit of checking unusual requests another way. Governed email signatures help in a smaller way: they keep brand, contact details and disclaimers consistent and current, so an email that arrives without them is easier to spot. But an email signature can be copied, so treat it as one signal, never as proof.
When the words can't be trusted, trust has to be built into the plumbing.
