DMARC explained

DMARC is an authentication, policy and also reporting protocol. It uses both SPF and DKIM and adds linkage to the “From” domain name, policies for handling the incoming email in case of failure and something very important – report for the sender. That way the sender can see if there is a problem, and act on it.

The main purpose of DMARC is to protect against direct domain spoofing. If an attacker tries to send email from not authorized, DMARC will detect it and block it.

Combined with BIMI, you will also give proper protection to your brand reputation by providing authentic messages.

Why SPF and DKIM are not enough?

SPF – Sender Policy Framework has the goal to validate the senders’ servers. The receivers check the SPF record and see the IP address. It should be matching the IP address of the domain of the sender.

A problem with the SPF is that the SPF record applies to the return path of the domains, not to the domain, that shows in the “From” on the user interface. DMARC fixes this flaw with alignment, a match, between the visible “From” and the server authenticated by SPF.

DKIM – DomainKeys Identified Mail. The owner can use DKIM record to sign the emails that it sends. The emails will have extra data (encrypted) in the header that can be verified through the DNS. This technology is not flawless too. Many companies don’t rotate the key, and that can be a big problem. This is another thing, DMARC fixes. It provides rotating keys.

How does DMARC work?

We mention already that DMARC uses policies. The administrator sets them, defining the email authentication practices and what should the receiving email server do if an email violates a policy.

When the receiving email server gets a new email, it makes a DNS lookup to check the DMARC record. It will look for:

• If the DKIM signature is valid.
• The IP address of the sender, if is one of the allowed by him (SPF record).
• If the header shows proper “domain alignment”.

With all of the above in consideration, the server DMARC policy to accept, reject or flag the email.

In the end, the server will send a message to the sender with a report.

Benefits of DMARC

Here are some of the main advantages of implementing this advanced protocol.

For the sender:

• Shows that the email uses authentication – SPF and DKIM.
• Receives a feedback about the sent email.
• Policy for failed email.

For the receiver:

• Provide authentication for the incoming emails
• Evaluating the SPF and DKIM
• See what the sender prefer – policy
• Returns feedback to the sender

DMARC Record example

DMARC records are a simple text (TXT) DNS records. They look like this:

“v=DMARC1;p=reject;pct=100;rua=mailto:postmaster@dmarcdomain.com”

• V – the version of the protocol. In the example is version 1
• Pct – % of the messages that are subject to filtering (pct=20)
• Ruf – URI for forensic reports (ruf=mailto:authfail@example.com)
• Rua – URI for aggregate reporting (rua=mailto:aggrep@example.com)
• P – Policy, organizational domain (p=quarantine)
• Sp – Policy, subdomains of the organizational domain (sp=reject)
• Adkim – Alignment for DKIM (adkim=s)
• Aspf – Alignment for SPF (aspf=r)

DMARC record generator by ClouDNS

Why use DMARC?

DMARC is a protocol used to help prevent email fraud and phishing attacks. Here’s why it’s important and why you should use it:

• Prevention of Email Spoofing: It helps prevent attackers from spoofing your domain, a common tactic in phishing attacks. By authenticating emails sent from your domain, DMARC ensures that only authorized senders can use your domain name.
• Improved Email Deliverability: Implementing it can help improve your email deliverability by reducing the chances of your legitimate emails being flagged as spam or being rejected by email servers. When email receivers see that your domain is protected by DMARC, they are more likely to deliver your emails to the inbox.
• Protection of Brand Reputation: Phishing attacks that use your domain can harm your organization’s reputation and trustworthiness. DMARC helps protect your brand reputation by preventing unauthorized use of your domain in phishing emails, thereby maintaining trust with your customers and partners.
• Visibility and Control: DMARC provides visibility into email traffic sent from your domain through reporting mechanisms. You can monitor email authentication results and receive reports on email activity, including information about legitimate and fraudulent email senders. This allows you to take proactive measures to protect your domain and email infrastructure.

What is an MX record?

Conclusion

DMARC can significantly lower the number of fraud emails and spam. It is not 100% bulletproof, but it adds a lot of extra protection in comparison with the other two solutions – SPF and DKIM. The reporting functionality is welcome plus too.

The post DMARC, the solution for your phishing problems appeared first on ClouDNS Blog.

Problems like these can seriously affect your business. Your clients can get phished and send their private information to a fake address which is pretending to be you. This can damage your reputation and can lead to different bans for you.

Understanding Phishing Attack and How to Stay Protected

If you have such problems, then you need a Sender Policy Framework (SPF) to prevent spoofing and improve the reliability of your e-mail server. It is a validation system that verifies the legitimacy of your email server.

To use it you need to create an SPF record for your domain name. It is a type of DNS record that verifies which email server can send emails from the name of the specific domain.

Let’s define SPF record

This is how it looks like:

v=spf1 +a include:cloudns.net ~all

It has different mechanisms:

v=spf1 – shows that it is an SPF record and is the version 1

+a – it is authorization to the host, that it can send emails

include: authorization of the emails, that they can be sent from that particular domain

~all – this shows that, if another server sends an e-mail for your domain, it must be accepted but handled as spam. You can use -all if you want all other servers to be rejected

There can be more mechanisms like:

all – make a match of all local and remote IPs

ip4 – define a particular IPv4 address or a range of IPv4 (example: ip4:192.168.0.1 or ip4:192.168.0.0/24 for a whole network)

ip6 – set a specific IPv6 address or a range of IPv6 (example: ip6:fc00::1 or ip6:fc00::/7 for a whole network)

mx – for each MX record, it specifies all A and AAAA records

Mechanisms can have qualifiers before them:

+ – Pass, the address passed the test, accept the email (example: +mx)

–  – Hard Fail, the address failed, don’t accept the email (example: -ip4:192.168.0.1 or -all)

~ – Soft Fail, failed the test but it accept the emails, just tagged them as fails (example: ~all)

? – Neutral, no pass or fail, do whatever, probably accept email (example: ?all)

How to add SPF record

Now when you know what an SPF record is, you can watch the following video tutorial how to add it.

For more information, you can also check our wiki page about SPF record.

The benefits of adding an SPF record are clear, stop the illegal spammers from using your domain name to send a fake email and to be phishing private data. In the other hand, it will reduce dramatically the number of your email that goes directly to SPAM by recipients.

So, do that extra text and add this SPF record to your DNS for additional protection.

The post What is Sender Policy Framework, and how to setup SPF record? appeared first on ClouDNS Blog.