DMARC, SPF, and DKIM: Understanding email authentication

Email cybersecurity is a key concern for companies today, especially for CIOs, CISOs and IT managers at SMEs and mid-sized companies. Phishing, spear-phishing, DDOS, ransomware, malware and spam attacks are becoming increasingly sophisticated. To counter these threats, it is essential to understand and implement robust authentication mechanisms such as DMARC.

What is the DMARC standard?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an open e-mail authentication protocol that ensures e-mail channel protection at the domain level. This protocol combines SPF and DKIM to provide an additional layer of authentication. It allows the sender to publish a policy indicating how authentication failures should be handled. In addition, DMARC can provide detailed reports on attempted fraudulent use of the domain, helping companies to detect and mitigate attacks. It is the first and only widely deployed technology that can make the “from” header of email reliable.

Some examples of DMARC applications

• Phishing prevention: email authentication, reducing the risk of receiving fraudulent emails (identity theft, scams, etc.).
• Reduced risk of Business Email Compromise (BEC): reception of emails from authorized sources only.
• Continuous monitoring: identify any suspicious activity bypassing incoming emails.
• Detailed reporting: detailed reports on email authentication, enabling security parameters to be adjusted.
• Advanced filtering: DMARC refines filtering parameters based on authentication information, enhancing detection of sophisticated attacks.

SPF and DKIM: what’s the link with DMARC?

SPF (Sender Policy Framework) is an authentication mechanism that checks whether the sender of an e-mail is authorized to send messages on behalf of a specific domain. In other words, it defines a policy that indicates which servers are authorized to send emails on behalf of a given domain. Recipients can verify the authenticity of the sender by consulting the domain’s SPF records.

DKIM (Domain Keys Identified Mail) takes a different approach, adding a digital signature to outgoing e-mails. This signature, generated by the sender’s mail server, is verified by the recipient’s mail server. The mail server generates a unique digital signature for each email, confirming its legitimate origin. When the recipient receives the email, the mail server verifies this signature, ensuring that the content has not been altered and that the sender is legitimate. If the signature is valid, this confirms the authenticity of the e-mail and guarantees that its content has not been altered in transit.

In direct relation, DMARC acts as a coordination system, reinforcing their effectiveness for better protection against cyber-attacks. By understanding this interconnection, companies can optimize the security of their professional messaging systems.

SPF, DKIM and DMARC: configuration and implementation

Securing your e-mails requires rigorous configuration of SPF, DKIM and DMARC. Here’s an overview of how to implement these crucial protocols:

• SPF: First you need to identify the mail servers authorized to send e-mail on behalf of your domain. Then, simply add SPF records in DNS to declare authentication policies.
• DKIM: For DKIM, you need to generate a cryptographic key pair (public/private) for the domain, then integrate the DKIM signature into the header of outgoing e-mails. Finally, you need to configure DNS records with the DKIM public key.
• DMARC: First, define a DMARC policy to specify how to handle emails that fail SPF and DKIM checks. Then, configure DMARC records in DNS to specify the policy, rejection percentage, and email addresses for reporting.

Facts and figures

According to a recent study by the European Union Cybersecurity Agency, around 40% of European companies reported having been the target of a phishing attack in 2022. However, DMARC remains unknown and unused by some SMEs, despite the fact that 81% of them exchange information by e-mail. Companies of this size are easier for cybercriminals to access, and 82% of those with DMARC reported a reduction in email spoofing.

Adopting these standards guarantees protection against email attacks while boosting recipient confidence. Careful configuration is essential to take full advantage of SPF, DKIM and DMARC in your cybersecurity strategy.

What are the advantages and limitations of DMARC?

In addition to protecting your company’s domain from unauthorized use, DMARC has other advantages.

• Reduced risk of phishing and business email compromise: DMARC, SPF and DKIM standards make it more difficult for cybercriminals to impersonate companies and mislead recipients.
• Improved email deliverability: Mail servers are becoming increasingly strict about email filtering, so DMARC ensures better email deliverability, preventing emails from being marked as spam.
• Enhanced protection against sophisticated attacks: Cyber attacks are becoming increasingly sophisticated. By adopting a multi-layered approach with DMARC, SPF and DKIM, companies can strengthen their security posture, reducing the chances of success of advanced attacks.

DMARC is a robust and complex technique that also has its limitations.

• Dependence on underlying protocols (DKIM, SPF): DMARC must be used in conjunction with other protocols to protect against email fraud.
• Inability to detect certain forms of identity theft: spear-phishing attacks using display name imposters such as Display Name Imposters (DNI) or similar domain spoofing.
• Need for correct implementation by senders: DMARC effectiveness depends on correct integration. Errors in configuration can lead to unpredictable results. This requires a thorough understanding of policies and parameters for correct configuration.
• Limitations in handling false positives and negatives: DMARC can cause unjustified rejection of legitimate emails and acceptance of malicious on

To gain in efficiency, the implementation of authentication mechanisms such as DMARC, SPF, and DKIM is essential. Altospam offers advanced solutions, rapid installation, an exceptionally low false positive rate of 0.01%, and in-depth experience in the field. By investing in solutions like Mailsafe, companies can guard against emerging threats and provide more advanced protection against increasingly sophisticated and ubiquitous threats.