What it covers. NIST guidance on improving the security and trustworthiness of email. It covers domain-based protections such as SPF, DKIM and DMARC, transport encryption between mail servers, and options for end-to-end message security. It is written for US federal agencies but applies to any organisation that sends and receives email.
In practice. Applying it well means publishing SPF and DKIM for every sending domain, moving DMARC towards an enforcement policy and monitoring the reports, and enforcing encryption in transit between mail servers where possible. Domains that do not send mail are also protected against spoofing. Evidence includes DNS records, DMARC report analysis and mail server configuration.
Common gaps. Common gaps are DMARC left at monitoring only, forgotten domains and third-party senders that are not authenticated. Mail from marketing platforms and other suppliers sending on the organisation's behalf is often overlooked when policies are tightened.