Pintu Bhatt

Implement DMARC in your organization using these Simple Steps

2021-11-15T11:56:24.722Z

DMARC stands for Domain-Based Message Authentication, Reporting, and Conformance, and it's an industry-recommended and recognized email authentication standard. Since the dawn of the digital era, the internet has been a fertile ground for hackers, impersonators, and threat actors that seek to deceive unwary clients and users by utilizing the corporate domains of small, medium, and big businesses.

This may have a significant impact on a company's credibility and reputation. By giving you the ability to prohibit impersonators from exploiting your domain name, DMARC can protect you from brand misuse and impersonation. As a result, DMARC implementation is critical for an organization's development, reputation, and security. This post will show you how to set up DMARC for your domain, whether it's for work or for personal use.

How EXACTLY will DMARC help my business?

EmailAuth gives companies and organizations control of their email domains via DMARC, which has the following advantages:

Protects brand reputation Regardless of the size or scope of the company, cybercriminals will attempt to spoof reputed websites and leverage their internet presence for harmful purposes. By keeping the brand name out of an attacker's arsenal of forged email domains, DMARC safeguards the brand's integrity.
Provides more insight into cyber threats DMARC allows organizations and domain owners to keep track of all authorized and non-authorized third parties who send emails on their behalf, ensuring compliance with security best practices.
Prevents email spoofing Every company wants to keep its domain safe against spoofing. This is advantageous for internal personnel, but it also stops spammers from using the company's domain to attack or impersonate other organizations. Two tools that can assist with this are SPF and DKIM. DMARC can be established after these two are in place.
Increases email deliverability Even genuine emails can end up in spam folders or quarantines, which can be problematic if the emails include sensitive medical details or other vital information. DMARC adds an extra layer of assurance that emails sent by a given organization are genuine, thus improving mailbox delivery while also combating spam.
The “p” tag has three options: None, quarantine, or reject. These instruct the server on what action is to be taken against an email that fails authentication.
The adkim and aspf options define how strictly DKIM and SPF policy should be applied, with ‘s’ indicating strict and ‘r’ indicating relaxed.
The RUA tag provides an address for aggregate data reports, whereas the RUF tag provides an address for forensic reports.

Steps to setup DMARC

After you've set up SPF and DKIM, it's time to set up DMARC. You can set up DMARC without first installing SPF and DKIM in a DNS record, but it will have no impact. SPF and DKIM records should be handled by email servers, according to DMARC requirements. The DMARC policy contains a reporting system that helps domain managers to determine if an email is failing authentication or whether an attacker is attempting to spoof a certain domain.

Setting up DMARC is very easy. It is a simple one-line entry in the domain’s DNS records.

Log into your domain registrar and select ‘Manage or Configure DNS Settings’ from the drop-down menu.
Select a TXT record and hit the ‘Add a New Record’ button.

Refer to the following DMARC record:

v=DMARC1; p=none; rua=mailto:reports@emailauth.io; ruf=mailto:reports@emailauth.io; adkim=r; aspf=r; rf=afrf

You’ve successfully set up DMARC for your business. Setting up DMARC in DNS only takes a few minutes. However, to be effective against brand impersonation, DMARC must be set to its highest enforcement level, p=reject.

While this is relatively straightforward when talking about a single domain, it can be complicated and time-consuming for organizations with thousands of domains spanning dozens of email senders and outside email distribution partners. Use EmailAuth ’s solutions for all your email authentication needs including SPF, DKIM, BIMI, and DMARC.

Step-By-Step Guide to configure DKIM

2021-10-18T11:16:21.258Z

In this article, we’ll learn about DKIM and how to correctly configure DKIM protocol for your domain to enhance email deliverability and security.

Step-By-Step Guide to configure DKIM

What is DKIM?

DomainKeys Identified Mail or DKIM is an anti-tamper protocol that ensures the security of your emails. DKIM protocol uses digital signatures to confirm whether the email was sent by an authentic sender.

The first DKIM action occurs on the server that sends a DKIM signed email, while the second takes place on the recipient server that checks DKIM signatures on incoming emails. The entire process is made possible by a pair of private and public keys.

The private key is kept secret and safe either on your own server or with your ESP. The public key, on the other hand, is added to the DNS records of your domain to broadcast to the world and help verify your emails. This is done by providing a digital signature for the email. Once the receiver verifies that an email is signed with a valid DKIM signature, it’s clear that the integrity of the email is preserved.

Now that you have a brief idea of DKIM, let’s learn how to implement the same.

DKIM configuration has three simple yet major steps.

Generate a public domain key for the concerned domain.

After you have decided the list of domains that you want to implement DKIM for, create a public key for the concerned domain. A selector name will have to be specified for your key pairs. It acts like a map for the receiving email server.

2. Add the public key to the DNS entries for that domain.

This key can be used by email servers to validate DKIM signatures in your messages. After you have created the keys, you will need to add the pair of keys to your DNS for the selected domains. It will be a TXT record with some value.

Sign in to your DNS management console.
Locate the page where you update DNS records.
Add a TXT record:

In the first field, enter the DNS Host name.

In the second field, TXT record value.

Save your changes.

These changes will take a day or two to reflect.

3. To begin applying a DKIM signature to all outgoing messages, enable DKIM signing.

After completing steps 1 and 2, enable DKIM signing by checking the box available on your DNS on all outbound emails for your domain. You can also test your DKIM set up by sending a test email or using EmailAuth’s free DKIM record lookup tool.

You have successfully configured DKIM for your domain. To learn more about DMARC, DKIM, and SPF, log on to https://emailauth.io/.

Content Source:- https://medium.com/@EmailAuth/step-by-step-guide-to-configure-dkim-3f353a1757c2

Why Should State and Local Governments Use DMARC?

2021-08-25T07:59:18.707Z

The protocol can assist government agencies in improving email security and building trust with residents and the private sector.

As shown by a recent attack on Missouri's state government, humble email systems remain an attack vector for malicious cyberattacks on state and local governments.

Thousands of domains at the state and local level — three times the number of federal domains — could benefit from the protection and benefits of email authentication. However, almost no state and local governments are making use of authentication standards that could help improve email security, especially against phishing attacks.

Currently, less than 1% of state and local government domains (and none of the primary.gov and.us domains in the United States) are properly secured against impersonation by using the leading email authentication standard, Domain-based Message Authentication, Reporting, and Conformance, or DMARC.

One-third of all state and local governments are attacked on a daily basis, while another half is targeted hourly.

“We believe that as the owner of a domain for a state or federal agency, you have a duty to protect user information,” he says. “If you haven't even locked down your email, it's difficult for states, municipalities, and local utilities to comply with PII or GDPR guidelines.”

Adopting DMARC not only enhances security but improves trust with residents and private sector companies that deal with the state or local government

What Is DMARC and How Can It Help State and Local Governments?

The industry standard DMARC is an email authentication policy and reporting protocol that is designed to prevent email spoofing, which is the foundation of phishing when malicious actors impersonate legitimate email senders to bait internal employees or deceive people outside an organization. DMARC was finalized in 2015 by contributors such as Google, Yahoo, Mail.Ru, JPMorgan Chase, and Symantec as parts of the Trusted Domain Project.

To improve and monitor domain protection from fraudulent email, DMARC “builds on the widely deployed SPF and DKIM protocols, adding linkage to the author (From:) domain name, published policies for recipient handling of authentication failures, and reporting from receivers to senders,” as according DMARC.org. Setting a DMARC policy of "reject" gives agencies the "strongest protection against spoofed email, ensuring that unauthenticated messages are rejected at the mail server, even before delivery," according to the US Department of Homeland Security.

How Public-Sector Officials Can Enhance Email Security

There are several reasons why state and local government adoption of DMARC may be low, especially compared to the federal government

In fact, state and local government CIOs and CISOs are unaware of the dangers presented by email and how easy it is to spoof emails. They believe that their emails are secure, but this is impossible until domains are authenticated.

Another reason for low adoption is the risk of blocking "good" emails in order to prevent "bad" ones from getting through.

DMARC assists organizations in avoiding email attacks and malicious actors from impersonating official domains. As a result, “people now trust your emails,” This is especially essential for government organizations that rely on residents and businesses to trust their communications in order to respond to notifications and file tax returns, for example.

Agency IT leaders can work with a number of suppliers to see if their domains are DMARC-compliant and how much of their email traffic is fraudulent. This then aids IT executives in deciding which domains need to be secured and locked down first. Those are usually the ones that deal with personally identifiable information.

Once DMARC is activated, it instructs any gateway, anywhere in the world, to send a report to the domain owner or anyone the domain owner authorizes. Such reports then show what is going on with the domain, such as if valid emails are getting through or whether malicious emails are being blocked.

How to Implement DMARC in Your Company

2021-08-24T10:48:56.856Z

Do you want to avoid phishing scams that use your company's domain name as a scam? The Doman-based Messaging, Authentication, Reporting and Conformance (DMARC) standard can help you achieve that. Continue reading to understand how to implement DMARC in your organization.

If your firm has technical personnel that understands DNS and your email system, this is something that can be done in-house. If you don't want to tackle it alone, there are DMARC Service Provider firms that can set up DMARC for you, as well as collect and analyses all of the email use statistics you'll be getting.

The steps following presume that the email administrator has previously set up the authentication techniques SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail).

The preliminary work

You must perform some prior work before deploying DMARC, including, of course, executive-level permission because this is a company-wide problem.

Next, compile a list of all approved email domains for your organization, including any external domains (such as marketing firms) that send mail on your behalf. This becomes the official list of approved email addresses—a whitelist if you will—for sending your letter. Any IP address that sends mail in your company's name but isn't on this list will have its messages deleted in the end. (But not straight away.) You'll have an opportunity to double-check that you've got every legitimate source.)

Notify the person or service provider in charge of your DNS infrastructure that you will need to modify your DNS record at a certain point.

To receive your DMARC reports, create an email address. You'll be able to choose how many reports you get, but you can anticipate receiving one daily aggregate report.

Ready for deployment

With those first steps done, it’s time for deployment.

Get out the list of all the domain names that send emails on your behalf. You need to deploy a DMARC DNS record for all of these domains

A text record connected to the parent domain is the DMARC record. "_dmarc.your domain.com," where "your domain.com" is substituted with your real domain name. The format of that record is described in the standards on the DMARC.org website. There's a wizard there that will guide you through creating your first DMARC record. The disposition of messages that are not DMARC aligned is what you write in the record. You want the ISPs to pass all of the messages through (that is, deliver them to their designated recipients) at first. You'll eventually want to state that records that don't match your DMARC record must be deleted.

When you set up the DMARC record, you’ll specify the email address where aggregate reports should be sent on a periodic basis, usually once a day.

The reports are sent in an easy-to-understand XML format. They detail the sources of your domains' messages as well as their DMARC alignment. A notification from Gmail, for example, may show that a certain IP address sent 300 messages using your company's domain name, none of which complied with your DMARC policy. That implies they are very certainly phishing emails, and you already know it's legal for ISPs to reject them instead of sending them. However, the mails might be from a legal domain that didn't make it into your domain list at first. Perhaps it's from a third-party email service provider you're not aware of. In this scenario, you must contact that provider and request that SPF and DKIM authentication be applied. They should no longer appear on DMARC reports after that, and you can be certain that their emails will not be deleted.

It's almost probable that the DMARC reports will include notations of messages that you don't recognize. That is because those are phishing emails. If your domain has been phished, this is how it will seem. The idea is that after you've completely activated DMARC, the communications will be deleted and will never be sent. This is where DMARC comes into play.

To obtain a decent picture of the email trends, you'll need at least a week's worth of reports. Once you have a solid idea of who is sending valid emails on your behalf, you can set up your policy and, if you haven't previously, your SPF and DKIM authentication.

Because it is based on the sending domain and maps it to a set of IP addresses, SPF is the easiest to set up. So you've got your domains, and you've got the IP addresses that are sending legitimately because you figured it out via the DMARC reports. The next step is to produce the required SPF record and publish it on the Internet.

Setting up DKIM is a little more difficult because it requires changing the settings of the email-sending system. An Exchange server, or an external third party or a gateway in front of the Exchange server, is usually the cause. That device must be updated to execute a DKIM signature, which must subsequently be advertised to the DNS in accordance with DKIM standards.

Domino's Pizza implements DMARC as part of a broader security strategy.

2021-08-19T11:52:46.719Z

In order to protect customers from "fake Domino's phishing attacks," Domino's Pizza Enterprises has deployed domain-based message authentication, reporting, and conformance (DMARC).

Back in early 2020, the quick-service restaurant (QSR) operator stated its security team reviewed "all-important email domains used by the firm and third-party partners to determine how email was being handled."

Domino's said in a sustainability report issued today that "the team then implemented specific DMARC records that clearly identified who could send emails on our behalf." [pdf]

“This was then monitored, before progressing to ensure only external systems with approval from Domino’s could send emails on our behalf.”

The DMARC installation was finished in March 2021, according to the pizza Enterprises, “protecting and verifying more than 51 email domains and more than 144 million emails per month.”

“The project protects not only our customers and the public, but also the Domino’s brand, and increases the likelihood genuine Domino’s emails will be delivered,” the company said.

“It's important that when a customer receives an email purporting to be from Domino's, it's sent by our teams, not by someone posing as Domino's - a major problem in the online retail world.”

The DMARC project was part of a larger set of security initiatives undertaken by Domino's over the past year, some of which are still ongoing.

In the financial year just gone, Domino’s said it conducted “data mapping exercises” across the group to improve security and governance protections for sensitive data.

The company also made sure that administrative accounts and “those that have access to large volumes of data” had multi-factor authentication enabled.

It also started work on a business continuity planning and disaster recovery programmer aimed at “identifying those systems, services, and data that are critical to the running of our company and work, as well as a risk mitigation programmer for any risks that may occur.”

On top of protecting outbound emails, Domino’s said “more than 10 million online ordering customer accounts were protected this year from account takeover attacks”.

It also said it processed 60 million security ‘insights’ every day, “generated from more than 26 different systems and services that we log and monitor.”

It added that machine learning is used to triage these event notifications to aid its security operations team.

DMARC, the Solution for your Phishing Problems

2021-08-18T12:18:48.611Z

Phishing attacks are a significant threat to any company. It may significantly harm the brand and reputation, as well as cause clients to lose faith and leave. The attackers can spam or phish using your brand logo and emails that look exactly like yours. Even you won't be able to tell the difference between a fake email and one received from your servers. SPF has been already discussed in terms of how it validates the outgoing mail server. Another DKIM technology is used for email signatures. Both are used by Domain-based Message Authentication (DMARC) to support popular actions. Double protection to reduce the risk of phishing and a monitoring system to help with management.

Why SPF and DKIM are not enough?

The objective of SPF - Sender Policy Framework is to validate the senders' servers. The receivers look up the IP address in the SPF record. It should be the same as the IP address of the sender's domain.

A issue with the SPF record is that it only applies to the domains' return paths, not to the domain that appears in the "From" field on the user interface. DMARC corrects this issue by aligning, or matching, the visible “From” and the SPF-authenticated server.

DomainKeys Identified Mail (DKIM) is an acronym for DomainKeys Identified Mail. DKIM can be used by the owner to sign the emails that it sends. In the header of the emails, there will be extra data (encrypted) that can be confirmed using DNS. This technology isn't perfect either. Many businesses fail to rotate the key, which may be a major issue. Another issue that DMARC addresses is this. It comes with rotating keys.

DMARC

DMARC is a protocol for authentication, policy, and reporting. It uses both SPF and DKIM, as well as connection to the “From” domain name, procedures for processing incoming email in the event of failure, and, most importantly, a sender report. The sender will be able to see whether there is an issue and take action as a result.

The primary goal of DMARC is to prevent direct domain spoofing. If an attacker attempts to send email from an address that is not authorized, DMARC will identify and prohibit it.

How does DMARC works?

We've already mentioned that DMARC uses policies. They are set by the administrator, who defines the email authentication processes and what the receiving email server should do if an email violates a policy.

When the receiving email server gets a new email, it makes a DNS lookup to check the DMARC. It will look for:

· If the DKIM signature is valid.

· The IP address of the sender, if is one of the allowed by him (SPF record).

· If the header shows proper “domain alignment”.

With all of the above in consideration, the server DMARC policy to accept, reject or flag the email.

In the end, the server will send a message to the sender with a report.

Benefits for the sender of the email

· Shows that the email uses authentication – SPF and DKIM.

· Receives a feedback about the sent email.

· Policy for failed email.

Benefits for the receiver of the email

· Provide authentication for the incoming emails

· Evaluating the SPF and DKIM

· See what the sender prefer – policy

· Returns feedback to the sender

Conclusion about DMARC

DMARC can significantly reduce the number of spam and fraud emails. It isn't completely bulletproof, but it provides far more protection than the other two options - SPF and DKIM. It's also nice to have reporting.

It's a human issue when it comes to email security.

2021-08-17T09:53:38.513Z

Phishing is the underlying cause of 32% of security breaches, according to research. Email is the most common point of entry for malware, providing access in 94 percent of cases.

Just last week, the UK government's Cyber Security Breaches Survey revealed that this worrying trend has not changed: 91% of big organizations are most likely to report phishing attacks as the source of a data breach, up from 72% to 83% in the previous four years. In the meanwhile, reports of other threats, such as computer viruses, have significantly decreased.

Regardless as to whether anti-malware software, firewalls, Sender Policy Framework (SPF), or Domain-based Message Authentication, Reporting, and Conformance (DMARC) solutions are in place, phishing emails are reaching organizations and individuals at an unprecedented rate, causing more consistent bad impacts than many other security threats combined. Due to the severity of certain phishing attacks and the scale of the businesses attacked, they have even made headlines.

FatFace recently paid a $2 million ransom after cybercriminals infiltrated their network via a phishing email, harvesting 200GB of data, including workers' bank account information. The original ransom of $8 million would have essentially put the shop out of business, as it was only making 25% of its usual revenue due to the pandemic. This should act as a chilling reminder of the devastating effects that poor email hygiene can have on businesses of all sizes.

So, what is the solution for companies like FatFace, or for people who are desperate to avoid being victims of this level of cybercrime? In the end, bolstering email security requires finding a balance between defensive technology and adequate employee training.

Even if a firm has the most secure defensive system in place, it will still be vulnerable unless it has a company-wide security-first attitude and a thorough awareness of threats and vulnerabilities.

Fostering a culture of training and education

When it comes to evaluating cyber defenses, culture is a significant issue, with a recent poll finding that 65 percent of firms who did not deploy a zero trust security approach did so because it did not fit with their company culture.

However, in defending a company's IT infrastructure, a security-first attitude is becoming increasingly vital, and organizations must examine if their culture prioritizes security or cultivates vulnerabilities. If they aren't completely revamping their security posture with a framework like zero trust, businesses should at the very least be regularly training and counseling their employees on how to identify and react to a malicious email.

Outsourcing white hat hacking and phishing campaigns that mimic real-world assaults should be included in adequate cybersecurity training and awareness to teach employees what they are doing wrong and how to distinguish between a dangerous and a safe email in the future. Importantly, when workers spot and report questionable conduct or communications, they should be rewarded in order to encourage continued vigilance.

The Three Pillars of Email Authentication: SPF, DKIM, and DMARC

2021-08-17T05:29:13.011Z

If you work in email marketing, you've most likely heard acronyms like "SPF," "DKIM," and "DMARC" tossed about without any explanation. Many people think you immediately understand these phrases, but the fact is that many marketers just have a hazy understanding of them.

The good news is that SPF, DKIM, and DMARC can all work together to provide you with a triple rainbow of email authentication, that’s why we want you to have a thorough understanding of them.. But these are three fundamental concepts to understand about email authentication.

We'll give you a quick and informative overview of each process, and then you'll be ready to start throwing acronyms about like a pro. First things first…

WHAT IS EMAIL AUTHENTICATION, AND WHY IS IT SO IMPORTANT?

By establishing methods that validate your domain as the sender of your messages, email authentication helps to increase the delivery and credibility of your marketing emails.

Using authentication will not ensure that your email reaches the inbox (you need focus on improving your email deliverability too), but it will protect your brand reputation while ensuring that your communications reach their intended recipients.

Read on to find out how to ensure you’re achieving the gold standard of email authentication.

3 TECHNICAL, BUT ESSENTIAL, EXPLAINATIONS OF SPF, DKIM, AND DMARC

SPF: Sender Policy Framework

The Sender Policy Framework, or SPF, allows recipients to verify the sender of an incoming email.

You can define which mail servers are authorized to send mail on your behalf by generating an SPF record. If you use a hosted email solution (Office365, Google Apps, etc.) or an ESP like Higher Logic, this is very useful.

Here's a brief breakdown of the process:

1. A record is added to the DNS settings by the sender.

a. The record should point to the domain used in their FROM: address (for example, if I send from bgurley@ABC.com, the record should point to ABC.com). All IP addresses (mail servers) that are allowed to send mail on behalf of this domain are included in this record. The following is an example of a typical SPF record:

v=spf1 ip4:64.34.187.182 ip4:66.70.82.40 ip4:64.27.72.0/24 include:magnetmail.net ~all

2. The DNS records are checked by the receiving server.

The receiving server verifies the DNS records for the domain in the FROM: field when the email is sent. The message passes SPF if the IP address is listed in that record (as seen above).

3. it’s a hard fail if SPF exists but the IP address isn't in the record.

It's called a "hard-fail" if the SPF record exists but the IP address of the sending mail server isn't in the record. Mail is often rejected or sent to the spam bin as a result of this.

4. it’s a soft fail if no SPF record exists.

A “soft-fail” occurs when there is no SPF record at all. These are the most common reasons for messages being routed to spam, but they can also result in a message being rejected.

DKIM: DomainKeys Identified Mail

DKIM (DomainKeys Identified Mail) allows for the identification of “spoof” emails as well, although it does it in a slightly different way. DKIM uses two encryption keys: one public and one private, rather than a single DNS record that specifies the FROM: address.

The private key is kept in a secure location that only the domain owner gets access too. This private key is used to generate an encrypted signature for every message sent from that domain. The message's receiver may validate the signature against the public DKIM key, which is stored in a public-facing DNS record. If the records "match," the mail could have only been sent by somebody who has access to the private info.

DMARC: Domain-based Message Authentication, Reporting, & Conformance

While both SPF and DKIM can be used separately, DMARC must rely on one of the two to provide authentication.

DMARC (Domain-based Message Authentication, Reporting, & Conformance) improves these technologies by instructing recipients on what to do if a message from your domain is not properly authenticated.

Like SPF and DKIM, DMARC also requires a specific DNS record to be entered for the domain you wish to use in your FROM: address. This record can include several values, but only two are required:

· (v) tells the receiving server to check DMARC

· (p) Gives instructions on what to do if authentication fails.

The values for p can include:

· p=none, which tells the receiving server to take no specific action if authentication fails.

· p=quarantine, which tells the receiving server to treat unauthenticated mail suspiciously. This could mean routing the mail to spam/junk, or adding a flag indicating the mail is not trusted.

· p=reject, which tells the receiving server to reject any mail that does not pass SPF and/or DKIM authentication.

DMARC has a reporting component that may be highly valuable for most organizations, in addition to the mandatory tags that indicate how to handle unauthenticated mail. Your business can receive reports indicating all mail sent with your domain in the FROM: address if you enable the reporting features of DMARC. This can assist in the identification of spoofed or faked mail patterns, as well as the detection of other business divisions or partners who may be sending mail on your behalf without authentication.

WHERE SHOULD YOU START WITH EMAIL AUTHENTICATION?

The first step is to speak with your email support team about how to ensure sure your emails are verified. There are also a variety of useful tools on the web, like SPF wizards and DKIM key generators, which will explain the process of creating a record how you can copy and paste into your domain management console.

We strongly advise utilizing SPF, DKIM, and DMARC to verify your messages, regardless of how you go about it. You'll be able to acronym like the best of them while preserving the safety and security of your brand's reputation.