Master Email Security With SPF, DKIM, and DMARC Protocols
Earn customer trust by adopting these authentication protocols
Email security never gets easier, does it? It seems like each new day businesses and individuals face a growing number of virus-infected emails and phishing scams they have to be on guard for in order to protect their systems and sensitive data. It can waste time, and it can sometimes be a bit of a gamble.
Are you willing to gamble your system’s security?
The good news is that you now have options for improved authentication protocols to adopt that can go a long way in protecting you from malicious emails. Even better, these improved protocols can protect you whether you’re the receiver or the sender.
Using a Sender Policy Framework (SPF)
Whenever you send an email, it includes additional text that is not always visible (depending on your email settings) that contains “return address” information for that email with details concerning the IP addresses and servers used to send the email. This is known as the Domain Name System (DNS) record. When spammers and phishing emails “spoof” an email address they take a trusted or reliable address and place it in the “From” field of your incoming email even though the email is actually coming from an entirely different source. This is meant to trick you into opening an email you might have otherwise sensibly avoided.
By applying a Sender Policy Framework (SFP) validation protocol you can detect and block email spoofing by checking the IP address the email claims against the IP address listed in the SPF record to see if they match up. If all looks good, then SPF authentication is approved and the message is delivered.
Using DomainKeys Identified Mail (DKIM)
If you’re concerned that information may be tampered with as your email is in transit, you can add an additional layer of security by using DomainKeys Identified Mail (DKIM). This adds a domain name identifier to the email which is unique and separate from any of the other identifiers. This new information is kept secure by encrypting it with a public and private key. The public key is sent as part of the DNS record and kept on the sender’s email server. The private key is stored on the sender’s computer.
Meant to encourage trust between sending and receiving servers, the DKIM information contained in the public key is compared to the decrypted private key to determine if the email headers have been altered during transmission or reception.
Using Domain-Based Message Authentication Reporting and Conformance (DMARC)
Domain-based Message Authentication Reporting and Conformance (DMARC) is an additional layer of security authentication that requires both the SPF and DKIM to verify that an email was legitimately sent by the owner of the “Friendly-From” domain appearing in the recipient’s DNS report. For this to happen, both SPF and DKIM must pass, and at least one of them must be aligned.
If both SPF and DKIM successfully pass, that confirms the email is originating from an approved server and that the header information has not been changed. As for aligning, one of the two authentication protocols must show that the sender owns the DNS field “Friendly-From” and confirms its accuracy.
For the SPF to align, the “From” domain and its “Return-Path” domain must match. For DKIM, the email’s “From” domain and DKIM d= must match.
Should the DMARC fail, the receiving computer can opt to either reject the email outright or place the suspicious email somewhere other than the Inbox such as a spam folder.
Why are authentication protocols so important?
Many businesses find their ability to send bulk emails is a great way to serve their customers. Bulk emails containing important service updates, recall notices, upgrade notifications, and other crucial business information are effective means to keep customers up to date on how your business continues to benefit them. Other businesses invested in sending bulk emails are legitimate telemarketers attempting to reach their target customers with valuable sales information.
Unfortunately, as phishing scams and spam emails continually on the rise, many businesses take an over-protective stance in regards to incoming email — particularly if it appears to be part of a mass mailing. This can lead to important, valid emails being sent to spam folders where they will sit unread, or be rejected altogether.
Many email services, including Google and Microsoft, are adding these protocols to their filtering methods. This is expected to go a long way toward bolstering a safe and secure email environment. Setting up the files needed for these protocols involves logging into your domain registrar to configure your DNS settings. It can get a little technical. If your in-house IT team is unprepared to handle this, contact any tech support you have an arrangement with, or look into consulting with a managed IT service provider for assistance.
If you want to impress upon your clients how serious you are about security and maintaining their trust, you’re going to want to look into adopting SPF, DKIM and DMARC authentication for your emails.
Thank you for reading. I’d love to share more with you via my Weekly Word Roundup newsletter sent to subscribers every Sunday. It will feature news, productivity tips, life hacks, and links to top stories making the rounds on the Internet. You can unsubscribe at any time!
