Since the advent of the internet, spam mail has been on the rise. 45% of emails sent are spam emails equating to about 14.5 billion spam emails daily. Many businesses and individuals fall victim to spam emails every day. Spam Email has adverse effects including increasing security breaches, decreasing productivity, and huge financial repercussions. The cost of email spam for businesses is approximately $20.5 billion annually. In the future, spam emails will cost businesses an estimate of $198 billion with 58 billion junk emails sent daily.

Various attempts have been made to create anti-spam tools in response to the spam mail menace. Unfortunately, these tools have been unsuccessfully in eradicating the spam plague as a fairly high number of spam messages are sent each day. Luckily, three relatively new tools namely SPF, DKIM, and DMARC are changing the spam mail landscape. If you are an email marketer, you have probably come across or heard these terms. Although you may have heard about these terms, the truth is that your understanding of them is vague, at best. This article comes in handy to improve your understanding of SPF, DKIM, and DMARC. It explains what they are and why you should use them.

SPF, DKIM, and DMARC are useful in email authentication to curb the spam menace. They work like a triple rainbow of email authentication. What is email authentication and why it is important?

Email authentication

It is a technical solution for verifying that an email comes from a credible source before it gets to the receiver’s inbox. Email authentication certifies that an email originates from the source it is claiming to be. It is widely used to block fraudulent emails like spams and phishing emails. The common email authentication standards are SPF, DKIM, and DMARC. These standards supplement SMTP in email authentication because SMTP lacks authentication mechanisms.

Importance of email authentication

These days, almost every business relies on email marketing to communicate with clients whether it is promotions, notifications or updates. Email authentication is a fundamental part of email marketing that many businesses’ neglect. By adopting email authentication, you can verify that emails are actually from your business and not spammers. The importance of email authentication includes;

• It verifies that an email comes from a legitimate source.
• It improves deliverability score.
• It prevents spoofing and phishing scams.
• It safeguards your brand, identity, and reputation.
• Present you and your domain as good netizens!

SPF

SPF is an acronym for Sender Policy Framework. It allows email senders to stipulate the IP addresses allowed to send mail for a specific domain. SPF helps to harden your DNS servers and limit those who use your domain to send emails.

Purpose

• SPF offers a way for email receipts to verify the identity of the sender of a mail.
• It aims to prevent sender address forgery. SPF concentrates on controlling and stopping tried sender address forgeries.
• It protects your organization from email abuse like spam, phishing, and malware.
• The main advantage of SPF is that it deters unauthorized sources from sending illicit emails from your domain.

DKIM

DKIM is an abbreviation for DomainKeys Identified Mail. It offers an encryption key and digital signature that confirms an email is authentic and not faked or modified.

Purpose

• It ensures that the content in your emails is trustworthy and not tampered with.
• It ascertains that an email sender is who they claim to be.
• It helps to identify ‘spoofed’ emails using two encryption keys –one public and one private. Only the owner of a domain can access the private key. He uses it to draft an encrypted signature that is incorporated in every message sent from his domain. The signature helps the recipient of the mail to confirm that the mail comes from the domain owner.

DMARC

Domain-based Message Authentication, Reporting, and Conformance (DMARC) aims to bring together senders and receivers to participate in establishing secure email communications. DMARC offers directions on what the receiver should do if a message from a domain fails the authorization test.  The email receiver can reject or junk such an email. Unlike SPF and DKIM that can be employed as stand-alone methods, DMARC depends on SPF or DKIM to offer authentication.    

Purpose

• DMARC alleviates email-based abuse by addressing the operational, deployment and reporting concerns related to email authentication. It allows an email sender to specify whether their emails are protected with SPF or DKIM.

Where to start with email authentication

The first step in email authentication is to dialogue with your email support on email authentication. The implementation guide for email authentication should start with the implementation of SPF followed by DKIM and finally DMARC to yield the highest level of effectiveness.

Implementing SPF

SPF is essential if you want to combat email forgery. It is simple and straight-forward to implement. The first requirement when implementing SPF is a DNS entry (TXT record). The contents for the SPF-related DNS entry are all the systems and devices that send emails on behalf of the domain ranging from the mail servers to the web servers. Do not forget to add the office scanner because it is also a mail sending device.

Ensure you double check the SPF record to ensure it includes all hosts or IP addresses. If the record is incomplete, some valid emails may be rejected or labeled spam. Any changes in IP addresses or hostname should be included in the DNS record. After generating SPF records, you have to add the TXT record to the authoritative DNS server. Importantly, for domains that do not send mail, publish null records. Ensure you test your records for correctness utilizing online tools like MX Toolbox.     

Implementing DKIM

In the case of Office 365 and G Suite, DKIM is enabled by default. In Gmail, for example, you can make sure that DKIM is enabled by clicking on Apps then G Suite then Setting for Gmail. If the tab ‘Authenticating email’ is in the color green, it means that DKIM is configured properly in the domain. If DKIM is not enabled, you can enable it by clicking the ‘Start Authentication’ tab on the lower right-hand corner.

If your business does not use Office 365, G Suite or cPanel that configure SPF and DKIM by default, you can implement DKIM manually. A site like Socket Labs can assist you with the generation of public/private domain key pairs and DNS entry. Since the private key signs all outgoing emails, it should be configured on the MTA. Also, the private key should be handled with care just like a sensitive password and not shared with outsiders. Do not forget to test the DKIM records and rotate DKIM keys regularly.

Implementing DMARC

DMARC relies on SPF and DKIM to properly authenticate emails and block fraudulent mails wanting to spoof your domain. An email passes DMARC checks after successfully undergoing SPF and/or DKIM authentication and alignment. DMARC enables the firm controlling the domain to determine how the email server should tackle the mails that fail DMAEC authentication.

DMARC implementation includes deciding the email address to receive XML reports and the initial policy for the domain settings. Stipulate whether to monitor emails that fail tests or block them. Just like in SPF and DKIM, add the DMARC record to the legit DNS for the domain. Do not forget to test records for correctness. The implementation of DMARC can be a lengthy process –taking even months- but the process is worth every second.           

Why should you implement SPF, DKIM, and DMARC?

• SPF, DKIM, and DMARC are effective ways to authenticate your mail server and prove to receiving mail servers like ISPs that senders have the permission to send mail.
• When you properly implement SPF, DKIM, and DMARC, you offer evidence that the sender is legitimate and they are who they claim to be and are not sending emails on behalf of someone else.
• SPF, DKIM, and DMARC importance is intensifying by the day and someday will be mandatory for all mail servers. Implementing the three checks ensures that your emails are delivered promptly rather than delayed or rejected.

 In the contemporary world, almost all types of transaction require some form of authentication. Whether you are a passenger boarding a plane, a patient requiring treatment or a customer using a credit card to pay for goods or services, you must prove that you are who you claim to be. You will be required to provide some form of evidence like a passport, health insurance card, identification card, or social security card that offers tangible identification. The same thing applies to the world of deliverability. To get through ISP filters, you must prove that you are a legitimate sender and not a spam or phishing attempt.

SPF, DKIM, and DMARC are email authentication standards that prove and protect a sender’s authentication and improve email security. They are techniques for fighting spamming and emails spoofing that have become prominent. However, email authentication standards require resources and commitment to implement and manage. Also, email spoofing, spamming, and phishing are three ways that hackers use to attack your corporate email. Organizations have to devise other threat protection mechanisms to identify, prevent, and mitigate other security threats.  Contact us for web solutions that will help you scale your business.