Email Authentication with SPF, DMARC, and DKIM

Protecting the Reputation of Your Email Domain

According to one statistic, in 2023, more than 45% of global email traffic was identified as spam. It roughly translates into more than 120 billion spam messages per day. Further, around 2.5% of all spam emails are scams or phishing attacks. Again, this translates into approximately 3 billion malicious emails per day.

So, major email service providers, such as Google, Microsoft, Yahoo, etc., deploy aggressive measures to combat such massive volume of spam and phishing emails. They vigorously blacklist email domains that may be sending unsolicited emails, spoofed emails, and phishing emails.

To be on the safer side of such aggressive tactics, you need to establish the legitimacy of your email domain with the help of email authentication mechanisms – SPF, DMARC, and DKIM. When properly configured, the email authentication protocols ensure that your emails are not marked as spam.

Protecting Your Email Domain Against Spoofing

Cybercriminals use “email spoofing” to forge the sender’s email address and make it appear as if the email is coming from a legitimate or trusted source. In other words, the attacker is impersonating or “spoofing” someone’s email address to trick the recipient into believing that the email is genuine.

Here’s how email spoofing typically works:

1. The attacker creates an email message and modifies the “From” field to display an email address that is not their own, often mimicking a legitimate organization, individual (e.g., CEO of the company), or brand.
2. The email content may include phishing links, malware attachments, or social engineering tactics designed to manipulate the recipient into taking a desired action, such as providing sensitive information or transferring funds.
3. The spoofed email is then sent to the intended targets, who may be more likely to open and engage with the message because they believe it’s from a trusted source.

To combat email spoofing, organizations implement email authentication protocols like SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance).

These protocols help the receiving mail servers verify the legitimacy of the sender’s email address and detect spoofed messages.

Email Authentication Protocols

There are three primary techniques for email authentication:

• SPF (Sender Policy Framework)
• DMARC (Domain-based Message Authentication, Reporting, and Conformance)
• DKIM (DomainKeys Identified Mail)

If these are not correctly configured:

• Your emails may be marked as spam.
• Your email domain might be put on a blacklist.
• Hackers and cyber criminals may spoof emails from your domain to scam your employees and customers.
• It can have a lasting negative impact on email deliverability.

By implementing SPF, DMARC, and DKIM, organizations can significantly reduce the risk of email spoofing and phishing attacks, thereby safeguarding their email infrastructure and maintaining trust with their recipients.

Configuring Email Authentication Protocols

Configuring email authentication protocols – SPF, DMARC, and DKIM, requires access to DNS management for your email domain.

Unless you have changed the nameservers for your domain, you can change your DNS settings from the control panel provided by your domain registrar (the company or entity where your website is registered, e.g., GoDaddy).

If you have changed the default nameservers of your domain, then you will have to figure out how to access the DNS settings.

Configuring SPF (Sender Policy Framework) Record

SPF (Sender Policy Framework) primarily addresses the problem of email spoofing. Email spoofing occurs when a malicious sender forges the email header to make it appear as if the email originates from a trusted source. This technique is commonly used in phishing attacks, spam campaigns, and other forms of cyber threats.

By implementing SPF, domain owners can specify which IP addresses are authorized to send emails on behalf of their domain. When an email is received, the recipient’s email server checks the SPF record of the sender’s domain to verify if the sending server is authorized to send emails for that domain.

If the sender (the server that sends the email) is not listed in the SPF record, the receiver (the server that receives the mail) can treat the email with suspicion or take appropriate action based on the SPF policy defined by the domain owner.

In summary, SPF helps prevent email spoofing by providing a mechanism for domain owners to declare which servers are allowed to send emails on their behalf, thereby enhancing email security and trustworthiness.

The SPF record is a TXT record in the DNS that lists the authorized IP addresses or hosts that can send email on behalf of your domain.

Here’s an example:

@ IN TXT "v=spf1 ip4:192.168.1.1 ip4:192.168.1.2 include:mail.example.com ~all"

This SPF record allows the IP addresses 192.168.1.1 and 192.168.1.2, as well as any IP addresses used by the mail server at mail.example.com, to send emails from the domain. The “~all” part tells receiving servers to mark emails from unauthorized IPs as “failed” rather than rejecting them outright.

Configuring the DMARC Record

DMARC (Domain-based Message Authentication, Reporting, and Conformance) solves several problems related to email security and authentication:

Email Spoofing and Phishing: DMARC helps combat email spoofing by enabling domain owners to specify policies for email authentication. By instructing receiving email servers on how to handle unauthenticated emails claiming to be from their domain, DMARC reduces the likelihood of successful spoofing attempts. This helps prevent phishing attacks where attackers impersonate trusted senders to deceive recipients into disclosing sensitive information.

Unauthorized Use of Domain: DMARC allows domain owners to gain visibility into unauthorized use of their domain in email communications. By specifying policies for handling unauthenticated emails, domain owners can detect and mitigate unauthorized email activity originating from their domain, protecting their brand reputation and integrity.

Email Delivery Improvement: DMARC provides valuable feedback and reporting mechanisms, including aggregate and forensic reports. These reports allow domain owners to monitor email authentication results, identify issues with their email infrastructure, and take corrective actions to improve email delivery rates and ensure legitimate emails are not mistakenly rejected or marked as spam.

Enhanced Email Security: By implementing DMARC policies such as “quarantine” or “reject,” domain owners can enforce stricter email authentication measures, thus increasing the overall email security. DMARC helps organizations protect their email systems from unauthorized access, data breaches, and other malicious activities, safeguarding sensitive information and maintaining trust with their recipients.

Here’s an example:

The DMARC record is also a TXT record that specifies your domain’s policies for handling failed SPF and DKIM checks.

_dmarc IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

This DMARC record instructs receiving servers to reject any emails that fail SPF or DKIM authentication (p=reject). It also requests that aggregate reports be sent to dmarc@example.com (rua=mailto:dmarc@example.com).

Configuring DKIM

DKIM (DomainKeys Identified Mail) primarily addresses the problem of email tampering and ensures the authenticity of email messages. Specifically, DKIM verified the integrity of the email message.

DKIM adds an additional layer of email authentication by allowing the sender to digitally sign their emails. This signature is added to the email headers using cryptographic techniques. Upon receiving an email, the recipient’s mail server can verify the DKIM signature by retrieving the public key from the sender’s DNS records. By validating the DKIM signature, the recipient can ensure that the email content has not been altered in transit and that it originates from the purported sender’s domain.

In essence, DKIM helps prevent email tampering and forgery by providing a mechanism for verifying the authenticity and integrity of email messages. By digitally signing outgoing emails, senders can establish a cryptographic trust relationship with recipients, resulting in increased confidence in the legitimacy of email communications.

This helps mitigate the risks associated with email-based attacks, such as phishing, spoofing, and data manipulation and ensures the trustworthiness of email communications in the digital ecosystem.

DKIM involves two types of DNS records: a TXT record with the public key and a CNAME record that points to the TXT record. Here are examples:

default._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0..."
selector1._domainkey IN CNAME default._domainkey.example.com

The TXT record contains the public key used for verifying DKIM signatures. The CNAME record maps a selector value (e.g., selector1) to the TXT record containing the public key. When sending an email, the DKIM signature is generated using the corresponding private key and includes the selector value, allowing the receiving server to find the right public key for verification.

Summary

• SPF prevents email spoofing by allowing domain owners to specify authorized senders.
• DMARC builds upon SPF and DKIM, providing policies for email authentication and reporting, thereby thwarting phishing attacks and unauthorized domain use.
• DKIM enhances email integrity by digitally signing emails, ensuring their authenticity, and preventing tampering.

Together, these protocols offer robust defenses against email-based threats, safeguarding sensitive information and maintaining trust in digital communications.

Useful Links

• Email Spam Statistics
• Importance of SPF Record
• What is DMARC?
• What is a DKIM Record?

Related

The Benefit of Outsourcing Your IT