Email Security
Check whether your domain publishes a DMARC record and review the email authentication policy it presents to receiving mail systems.
DMARC — Domain-based Message Authentication, Reporting and Conformance — works with SPF and DKIM to help domain owners protect their domains against certain forms of email spoofing and impersonation.
WebInspect checks the publicly available DMARC configuration for your domain as part of its domain security inspection.
DMARC is an email authentication policy published through DNS.
It allows a domain owner to provide instructions about how receiving mail systems should handle messages that do not pass the required authentication and alignment checks.
DMARC builds on two other email authentication mechanisms: SPF and DKIM.
Together, these technologies make it more difficult for unauthorized senders to successfully impersonate a domain in email.
DMARC policies are published as DNS TXT records under the _dmarc hostname for a domain.
A DMARC record contains a collection of parameters known as tags.
One of the most important is the policy tag, p.
Common policy values include:
p=none
This is primarily a monitoring policy. Messages are generally not requested to be quarantined or rejected based solely on DMARC failure.
p=quarantine
This requests that messages failing DMARC evaluation be treated as suspicious, which may result in placement in spam or quarantine depending on the receiving provider.
p=reject
This requests that messages failing DMARC be rejected.
Not necessarily.
A p=none policy is frequently used while an organization monitors its email ecosystem and determines which systems legitimately send email on its behalf.
Moving immediately to a restrictive policy without understanding legitimate senders can cause valid email to fail authentication.
DMARC deployment should therefore be planned carefully, particularly for domains using multiple email providers, marketing platforms, CRM systems, ticketing systems or third-party applications.
DMARC should not normally be considered in isolation.
SPF identifies systems authorized to send email for a domain.
DKIM allows email to be cryptographically signed so that receiving systems can verify that the signed portions of the message have not been modified and that the signature corresponds to the signing domain.
DMARC then evaluates authentication and domain alignment and allows the domain owner to publish a handling policy.
A useful email security review should therefore consider all three technologies.
Domain impersonation is frequently used in phishing and fraudulent email.
An attacker may attempt to send a message that appears to come from a legitimate organization even though the organization's real email infrastructure was never involved.
Properly implemented email authentication makes this type of abuse more difficult and provides receiving mail systems with additional information for evaluating messages.
DMARC reporting can also give domain owners visibility into systems sending email using their domain.
No.
DMARC is an important email authentication control, but it cannot prevent every form of phishing.
Attackers can use lookalike domains, compromised legitimate accounts, misleading display names and many other techniques that do not require directly spoofing the protected domain.
DMARC should therefore form part of a broader email and domain security strategy.
WebInspect can check your domain for DMARC, SPF and other externally visible email security information.
Run a free domain security inspection to see what your domain currently publishes.