Fidem handles activation and the path to enforcement. The full product page is email identity protection on defensio.technology, with guides on DMARC, lookalike domains and MTA-STS.
Defensio Identity Shield: Email Identity Defense for Your Domain
Defensio Identity Shield defends the organization’s email domain from spoofing, BEC fraud and lookalike domains. It continuously monitors the domain’s DMARC posture, runs scheduled spoofability tests, watches for registrations of domains that imitate your brand and oversees email transport encryption (MTA-STS, TLS-RPT). No mail passes through Fidem and the email flow does not change: a single DNS record is all it takes to start.
What Identity Shield Does
Four safeguards that work together on the domain’s email identity:
Domain posture
DMARC Monitoring
Continuous collection and analysis of the reports that the large providers send about who writes on behalf of your domain: who passes the checks and who does not, presented in plain language, with no files to interpret by hand. The posture is tracked over time, with gradual guidance towards the enforcement policy, and if a defense stops working you know immediately, not after the fraud.
Field testing
Scheduled Spoof Tests
We do not just read the reports: the defenses are put to the test on a schedule, with a forged message sent to a mailbox registered and controlled by the client. It tells you whether the domain is actually spoofable today. Tests reach only the seed mailbox, never users and never as a campaign, with headers that declare them, and a real send happens only with written authorization.
Domains that imitate the brand
Lookalike Domain Surveillance
It finds registrations of domains that look like yours, such as a missing letter, two swapped letters or a digit in place of a letter, and above all it separates those that are merely registered from those that are armed: with a configured mail server, a TLS certificate or a live website, in other words ready to use. It is the difference between noise and a real threat.
Transport encryption
MTA-STS and TLS-RPT
Oversight of transport encryption: the policies that require recipients to deliver mail only over encrypted channels, and the reporting that signals when negotiation fails. Alerts do not stay isolated: they arrive inside the SOC, together with the rest of the telemetry and the same analysts.
It Is Not an Email Filter
The mail gateway and Identity Shield solve opposite problems: the gateway filters the mail that reaches you; Identity Shield deals with the mail sent in your name to customers, suppliers and employees, which your gateway never sees. And unlike a simple DMARC report reader, the defenses are actively tested and lookalike domains are rated on their actual danger.
The Goal: DMARC at Reject, Safely
A DMARC policy set to reject is the only control recipients apply whatever route the forged message took: it is what shuts down spoofing of the exact domain. But getting there safely requires visibility: you must know every legitimate sender before telling recipients to reject, or you block your own mail. Identity Shield guides the whole journey.
ACN Guidelines on Email Security
Italy’s National Cybersecurity Agency (ACN) has published guidelines on email protection that recommend organizations adopt SPF, DKIM and DMARC, with enforcement policies, and protect transport with MTA-STS and TLS-RPT. According to industry surveys, a significant share of organizations today cannot prevent third parties from sending fraudulent emails in their name.
Defensio Identity Shield implements and maintains over time exactly the setup recommended by ACN: continuously monitored domain posture, a DMARC policy guided safely to enforcement, periodic tests that verify it holds, and oversight of the MTA-STS and TLS-RPT records. Not a one-off configuration, but a continuous control.
Standalone or in the Ecosystem
Identity Shield can also be bought on its own, without other Defensio components. Those who already use Defensio SECaaS find it as an add-on in the same platform, with the same account. Connected to Defensio SOC, its alerts flow into the operations center’s correlation together with those of the other components.
For organizations subject to NIS2 (Italian Legislative Decree 138/2024), protecting the email channel from spoofing and BEC fraud is part of the risk management measures: see the NIS2 compliance path with Fidem.
NG Reporting Included
Like every component of the ecosystem, Identity Shield includes the NG (Next Generation) reporting engine: domain posture, spoof test results and lookalike domain surveillance become compliance-ready reports, generated and distributed on schedule.
Find Out Who Is Sending in Your Domain's Name
Contact us for an assessment of your domain’s email posture, or see details and activation at defensio.technology/identity-shield.
Explore the other components: Defensio Ecosystem · Defensio Sensor · Defensio SOC · Defensio XT · Defensio SECaaS