Chapter 8 : The Importance Of DMARC And DKIM And Ensuring Their Proper Functioning
Understanding The Concepts Of SPF, DKIM, And DMARC
Below is a brief description explaining what is SPF, DKIM, and DMARC.
- Sender Policy Framework (SPF) is a DNS TXT record specifying which IP addresses/servers are authorized to send emails from a specific domain.
- Domain Keys Identified Mail (DKIM) provides a cryptographic signature to the emails to ensure that there has been no tampering with them during transit.
- Domain-based Message Authentication, Reporting, and Conformance (DMARC) works with SPF and DKIM to verify that the sender’s email messages have SPF and DKIM protection. It also tells the receiving server what to do if neither of these authentication methods passes. It provides a channel for the receiving mail server to report to the sender about messages that pass/fail DMARC evaluation.
Difference Between DKIM And DMARC
DKIM is a TXT record that is added to the domain’s DNS. It certifies that the email has not been tampered with during transit.
DMARC is a protocol that confirms that the emails have SPF and DKIM protection. It also tells the recipient servers what to do if the emails do not pass SPF and DKIM. DMARC ensures sending a report to the sender that messages have passed/failed DMARC evaluation.
While DKIM is a standalone authentication standard, DMARC works with SPF and DKIM as a security protocol.
Important Functions – Tips to implement authentication protocols properly
The following tips can help users avoid mistakes while applying authentication protocols.
- You must remember to include your outgoing mail gateways’ hostnames in your SPF records.
- Do not forget to create an incoming content filter and apply it to appropriate incoming mail policies.
- Drop all messages that fail -all in SPF records and quarantine messages that softfail. Quarantining all SPF -all failing messages and monitoring them can ensure there are no false positives.
- If you provide email services for third parties, you should ensure they add hostnames/IP addresses you use to deliver their messages to their SPF records.
- Creating and assigning DKM verification profiles to different mail policies allow you to limit the size of the signatures you accept.
- It is better to quarantine messages failing DKIM rather than dropping them.
- One should never drop any messages unless explicitly stated by the customer. Hence, one should set the default DMARC verifications profile to “No Action.”
Quick Links
Common Email Problems And How To Resolve Them
Common SPF Issues
Monitoring Email Flow For Clients
Tenant Migration Issues And Resolution
Spam Filtering Problems
How To Secure And Authenticate Customers’ Emails
Uncommon Email Problems And Solutions
The Importance Of DMARC And DKIM And Ensuring Their Proper Functioning
Is DMARC Reporting Required For MSPs To Have Happy Customers? – Myths About DMARC Debunked