DMARC Record Missing Alerts

Have you heard of DMARC?  It is the newest way to protect your email delivery and online reputation from delivery failures, misconfigurations and fraud and phishing attempts.  If you aren’t using DMARC, you are at risk from email delivery failures.  Learn more about DMARC, DMARC Compliance and Email Delivery.

Since DMARC is such a pivotal technology, we have decided that our customers need to be alerted when it is not configured.   Therefore all MX record lookups will show a critical warning when a DMARC record is not found (see below).  Paid users with MX monitors will receive critical alerts that a DMARC record is missing or misconfigured for their domain.

DMARC record missing.png

MxToolbox experts feel that DMARC is critical to your business success.  Our team is ready to help you with your DMARC configuration and transition to a focus on proactive email delivery management.  Our most recent products MxToolbox Delivery Center and MxToolbox Fraud Center leverage DMARC to improve your email delivery and protect your brand from email fraud.

What is Email Phishing?

There has been a lot of discussion about Email Fraud and Phishing lately.  Email is still the largest threat vector for hacking and information theft.  Email phishing is one of the best way to obtain access to accounts, but what is email phishing really?

Phishing is when a 3rd party, typically a hacker or malicious website, uses the brand identity of a company to lull a user into exposing private information.  Phishing emails target email address with an email that looks just like a legitimate service provider to implant malware in a download or obtain login credentials for that domain.  For example, you might receive an email that looks like it comes from a financial institution like Paypal (see mine below) asking you to download a document or go to a link to stop or start a transaction, or change your password.

phishingemail

Example Phishing Email

Identifying Phishing Emails

Phishing groups and hackers are constantly changing their patterns to improve both their targeting and the effectiveness of their emails in order to exploit users, but there are a few characteristics in common for every phishing email.

Phishing emails leverage a strong brand

In my example, the “From” email address used Paypal’s, but I have seen it with many big brands, especially in credit cards, financial, banking and insurance industries.  Ask yourself:  Do you really have an account? Is this the email address for that account? Have you done anything with the account lately?

There is a sense of urgency

The email will require you to “act soon” or it will cost you money.  This sense of urgency makes you react before you think.  Take a breath before acting on any email that looks really important.  

Quality Varies

Some phishing emails, like the one above, look good on the surface.  For example, the logos look correct, the fonts and color scheme are appropriate and some of the language is even straight from legitimate emails.  However, when you read deeper you can see spelling mistakes, grammatical errors or other areas where it is clear the writer was not a native English speaker.  Notice above that “DeLL” is not written correctly nor is the phrase “This not you?” proper English.  Take a moment to read the information presented in the email and check grammar and spelling.

“From” domain and Return Path Domain will not match

It is relatively easy to spoof a “From” address.  Email Standards allow 3rd party emailers to send email on behalf of another domain, otherwise inbox providers like Google and Outlook.com or bulk email providers could not send email for the business or personal domains they host.  If “From” and Return Path do not match and the Return Path looks random or shady, it’s a good chance you have a phishing email.  Further, most companies will not use a 3rd party to send important account information emails like the one above, but their own internal servers.  Check the Return Path email address in the header to see if it looks legitimate.

There is an attachment

If you are required to download anything that you did not ask the company for, then it is probably a phishing email and may contain malware.  Even PDFs or DOCs can contain malware payloads.  At minimum, they are trying to lull you into thinking that their fake document is valid so that they can get personal, private or financial data from you.  Do not download attachments you did not ask for.

Links on the page go to a different domain

Often a phishing email will include a link to a 3rd or 4th domain or just to an IP address.  The goal here is to get you to click unsuspectedly on any link so they can further the con and grab your information when you attempt to login to their fake website.  Sometimes the domains even look like subdomains or related domains.  Always check links before clicking on them.  If in doubt of any link, open a clean window and navigate to the company’s website and login to your account from there to check on the issue.  

About MxToolbox

MxToolbox is the expert in email delivery, including the prevention of fraud and phishing.  Our focus is to help companies reduce the threat to their brand so that their customers, users and employees can trust that emails “From” their domain are legitimate.  Our Fraud Center product leverages international standards DMARC, DKIM and SPF combined with cutting edge algorithms to help small-enterprise companies halt phishing emails from their domain.  Learn More

Improving DMARC Compliance

In recent months, DMARC has become increasingly mentioned in the news as a way to reduce spam, improve email deliverability and reduce the potential for fraud and phishing.

  • In early 2017, UK National Health Service required DMARC as the default for email services.
  • In July, a US Senator Ron Wyden sent an open letter to the US Department of Homeland Security requesting the agency take steps to protect all Federal agencies with DMARC.
  • In August, the UK’s HMRevenues & Customs announced that it had stopped over 300k phishing emails using DMARC.
  • In October, the US Department of Homeland Security directed Federal agencies to adopt security technologies like DMARC.

With all this attention, businesses are starting to realize that adopting DMARC helps them in two ways:

  • Inbound – using DMARC to screen incoming emails for compliance can limit your company’s exposure to fraud and phishing emails, scams and malware.
  • Outbound – sending email that is DMARC compliant can improve email delivery to your customers and limit the potential negative impacts of 3rd parties that try to use your domain for fraud or phishing.

MxToolbox highly recommends that every company implement DMARC for both inbound email screening and outbound email delivery.  Inbound email screening is dependent on your particular email service.

How does DMARC work for outbound email?

DMARC works in conjunction with two other technologies: SPF and DKIM.  SPF allows you to designate 3rd parties as legitimate senders for your domain.  More on SPF here. DKIM allows you to take responsibility for your email by cryptographically signing your email.  SPF, DKIM and DMARC use DNS records to specify the IP addresses, domains and security keys for your particular configuration.

DMARC requires both SPF and DKIM to function properly.  Once you setup SPF and DKIM you can setup DMARC to get information on how your outbound emails are performing – whether or not emails coming “from” your domain are compliant with the definitions in your SPF and how many of your emails are compliant with DKIM.

With a DMARC record, you specify an email address for aggregate feedback about your SPF and DKIM compliance, an email address for specific forensic feedback related to failed emails and how email that fails compliance should be handled by the recipient – ignored, quarantined or rejected.

How do you improve your DMARC Compliance?

DMARC Compliance is based upon SPF and DKIM compliance rates.  In order to improve your outbound DMARC compliance and therefore your email delivery rates, you must:

Setup DMARC with both RUA and RUF

RUA and RUF designate email addresses where you can receive summaries of authentication and alignment pass/fail and detailed forensic information on failed emails.  As this is the only way to receive feedback, setting up these email addresses is extremely important.

Monitoring your DMARC Feedback

Inbox providers will respond to these RUA and RUF tags by sending summaries.  Unfortunately, the summary digests and forensic details are not quite human readable.  If your outbound email volume is over a few hundred emails a day, you need to consider some way to decode these digests.

MxToolbox provides a service, Delivery Center, that decodes these digests, summarizesthem and gives you granular reports on how your emails are performing.

dc_dashboardWith tools like Delivery Center, you can review the IP addresses and Domains sending on your behalf to determine how your legitimate senders are performing and who is using your brand/domain name to commit fraud and phishing.  It is important to investigate domains and IPs that fail SPF, DKIM and DMARC regularly so that determine if they are legitimate and need to have their configuration updated or illegitimate and need to be blocked. As your investigations progress and you improve your configurations, you will have more confidence when you decide to tell recipients to block failed email.

 

Act on DMARC Forensic Responses

DMARC forensic reports provide you with detailed information about the emails that have failed SPF, DKIM and DMARC checks.  You can use this information to investigate threats to your brand or problems with your 3rd party emailers.

Tools like MxToolbox Delivery Center give you immediate access to DMARC forensic reports that enable your detailed investigations.

Summary

The best way to improve email delivery is to adopt new technologies SPF, DKIM and DMARC and leverage a tool like MxToolbox Delivery Center that gives you insight into how your email is performing.  With the right tool, you can keep tabs on your email configuration, understand the threat to your brand, and improve email delivery.

Improving DKIM Compliance

Adopting DKIM can make a huge difference in how the email you send is perceived by recipients.  With DKIM you are taking ownership of an email by cryptographically signing each email.  Recipients then decode the signature to verify that you sent the email.  DKIM, in short, is like putting a wax seal on a letter that uniquely identifies you.

How can you improve DKIM compliance?

Get Informed

The first thing you need to improve DKIM compliance is a method to understand what your current compliance rate is.  To do this, you need:

  1. Adopt DMARC.
  2. Have a method to parse and report on DMARC digests coming from inbox providers.

DMARC responses from inbox providers are often not-quite human readable and the larger the volume of email you send, the more complex the responses.  To parse these, you need a product that summarizes them and provides reports that you can understand.

MxToolbox Delivery Center was designed to provide you with a complete understanding of who is sending email on your behalf and how your emails are performing with respect to SPF, DKIM and DMARC compliance and how likely your emails are to be rejected by inbox providers.

Get Control

Now that you have insight into what emailers are compliant, the second step to improving your DKIM compliance is to take control of the compliance of your internal emails and 3rd party emailers.

Investigate internal systems that might be sending email on your behalf and make sure that those systems are capable of signing outbound email with your DKIM signature.  These could be anything from marketing automation and sales systems to order entry, vendor management or customer support.  Regardless if they are home-grown or off-the-shelf, if the system is sending email, it needs to be DKIM compliant or the email may be rejected.

Similarly to internal systems, you must take a look at external, 3rd party providers to understand if they can be DKIM compliant.  Most external providers can sign email with a DKIM key, however, email forwarders are much less likely to be DKIM compliant than bulk emailers or other 3rd party service providers.  Talk with each of them to setup DKIM compliant email.

Repeat

Getting DKIM compliant is not a one-time project, but an on-going process.  To ensure high levels of compliance long-term, you will need to:

  • Regularly check compliance rates
  • On-board new internal and 3rd party systems to be compliant
  • mdcpro_inboxSetup processes to assess new applications and providers based on their DKIM support

MxToolbox Delivery Center gives you everything you need to analyze SPF, DKIM and DMARC compliance rates, identify problem internal services and external 3rd party providers and react to threats to your reputation where services are blacklisted or non-compliant.

Summary

DKIM Compliance is an on-going process that requires regularly investigation of DKIM compliance rates with tools that give you insight into the IP addresses and 3rd party tools and domains that are sending email on your behalf.

Improving SPF Compliance

SPF can be a huge benefit to your email delivery.  SPF, in short, lets you state who you trust to send your email.  The more email sent on your behalf that complies with your SPF rules, the more of your email will be accepted by email inbox providers and your intended recipients.

How does SPF work?

SPF is a DNS record type that gives you the option to declare all the IP addresses, domains and 3rd party providers that you use, and also limit the list of valid emailers to only what you list.  By setting these limits, you could shut down potential fraud, spoofing or phishing threats and improve your reputation with customers and vendors.  Spoofing and phishing scams are incredibly common place, even using credentials from legitimate small and medium sized businesses.  Email that is SPF compliant is more likely to get to a customer’s inbox.

How can you improve SPF Compliance?

First, you need to understand what your compliance rate is.   To get your compliance rate, you’ll need to elicit feedback from your recipients.  Fortunately, you can do this by setting up a DMARC record, something that MxToolbox can help you with.  DMARC records include an RUA declaration which defines who gets SPF and DKIM compliance information about your email.

Compliance digests can be cumbersome to read, process and understand, especially if you have more than a very small volume of outbound email.  Getting help processing these files, like with MxToolbox Delivery Center, is a necessity.  However, once decoded, you’ll get information about ALL the IP addresses and Domains that send email on your behalf and how much of that email volume complies with SPF or DKIM.  Now’s the time to consider how to improve compliance:

  1. Take note of IP addresses and domains that are low in compliance
  2. For each IP address and domain, investigate the origin
    • Is the domain an email partner that wasn’t included in your SPF record?  Commonly, CRMs, Email Marketing, Marketing Automation, Order Management and Customer Support/Ticketing Systems send email on your behalf.
    • Does the IP address belong to you, an existing partner or a new email partner?  It is common for partners to add a new IP range from time to time.
    • Does the IP address belong to a forwarder one your partners uses?  Forwarders are more difficult to track down but you may need to investigate or change your contract terms.
    • Can you trace the IP address to a place you don’t do business or a location of frequent scammers?  It is frequent
  3. For valid IP addresses and domains, add them to your SPF (or negotiate with the department that hired them to stop using that service)
  4. For invalid IP addresses, there are options you can take through DMARC to instruct your recipients to reject SPF-non-compliant email.

This is an iterative and continuous process.  New services will be added and IP addresses change all the time.   SPF Compliance requires regular review of your DMARC digests and statistics.  However, all this work will improve your email delivery and your online reputation.

MxToolbox Delivery Center is your solution for managing SPF and DKIM compliance and understanding the complexity of DMARC setup.  MxToolbox experts developed Delivery Center to help customers like you improve email deliverability, manage their online reputation and head off fraud and phishing issues.

Understanding Email Delivery

Email delivery is more than simply having an email service or configuring an email server.  Today, with outsourced email providers, 3rd party emailers, bulk emailers and spoofers, email delivery requires a multi-faceted approach that might seem daunting to many.  MxToolbox, your expert on email delivery, helps companies like yours navigate the complexity.

  1. Managing Blacklist Reputation
  2. Managing 3rd Party Emailers
  3. Taking Ownership of your Email
  4. Requesting Feedback on your Email
  5. Iterative Management of your Feedback

Managing Blacklist Reputation

The first line of defense against bad emailers is the blacklist.  An IP address or Domain on a blacklist typically means that the IP address has sent spam or the Domain on the list has been included in the body of spam email messages.  A receiver will reject email from that IP or any message that includes that Domain.  Because your email may be rejected outright, monitoring the IP addresses of your outgoing mail servers for blacklisting is a necessity.  (Monitoring your domain for blacklisting is somewhat less valuable as domain blacklists only report if a domain is in the body of controversial email, rather than being the sender of the email.)

MxToolbox has email delivery plans that include blacklist monitoring to get you started on the path to managing your email deliverability.

Managing 3rd Party Emailers

As your company grows, you will probably move more of your outbound email to email services from a third party provider in some form or fashion:

  • Bulk Emailers – Marketing will outsource the delivery of newsletters or advertisements, or signups emails.
  • CRMs and Marketing Automation – Sales/Marketing adds a CRM system or Marketing Automation system, either online or locally, that sends important email to customers.
  • Order Entry/Fulfillment – Online businesses especially rely on 3rd parties for order entry or fulfillment which may send email on behalf of the original seller.

Regardless of the application, tool or service, there are multiple IP addresses or Domains that could be legitimately sending email on your behalf.  Declaring this relationship publicly through SPF makes it more likely that your 3rd party email will get through to your customers, partners and vendors.

MxToolbox can help you setup your SPF records and check your existing SPF records for compliance.  Once SPF is setup, you will need to maintain the list of IP addresses or domains of 3rd party emailer and regularly check your record for compliance.

Taking Ownership of your Email

Anyone can say that they are sending email on your behalf, but how do you ensure that recipients trust that the email is from you?  If it were a letter, you’d sign it, right? SPF allows you to designate who can send on your behalf but that’s only one part of it.  DKIM allows you to actually sign an email and take responsibility for the email’s content just like a signature on a letter.  As such, implementing DKIM gives your recipients a level of confidence that you take responsibility for the content of emails coming from your domain, including spam, viruses and malware.

MxToolbox experts can help you with your DKIM setup.  Our team has a deep understanding of the problems businesses face implementing new technologies and experience helping small, medium and large businesses with DKIM.

Requesting Feedback on your Email

Wouldn’t it be nice to know what a recipient organization thought of your email?

Wouldn’t it be nice to know if they classified it as spam or passed it through to their inboxes?

Wouldn’t it be nice to know who (IP addresses and Domains) are using your good name to spoof email?

Wouldn’t it be nice to know if your 3rd party emailers are passing SPF and DKIM checks and being delivered?

DMARC is a standard that uses DNS to set how a sender obtains feedback from recipient organizations on email purportedly sent from the sender’s domain.  Any recipient can bundle up statistics on emails received from your domain and send them back in a digest format.  They can also send forensic data that includes individual troublesome email.  DMARC, in short, gives you insight into your email deliverability across your own servers, 3rd party emails, and potential fraud and phishing schemes.

Setting up a DMARC record and analyzing the feedback is the next step you must take to manage your email deliverability.  MxToolbox experts know DMARC and our newest product, Delivery Center, makes it easy to process the feedback you are receiving via DMARC, get insight into issues with 3rd party senders and make early detection of potential fraud and phishing schemes.

Iterative Management of your Feedback

Once you start receiving DMARC digests and forensic reports, you will begin to see patterns in email sent on your behalf:

  • Legitimate Senders not in your SPF
  • Legitimate Senders/Forwarders without proper DKIM signatures
  • Legitimate Senders that you may not have known about
  • Illegitimate Senders looking to leverage your brand

All of this feedback gives you the opportunity to manage how recipients process your email. By updating the policy on your DMARC record and the level of filtering recommended, you can tell your recipients to quarantine or outright reject email that doesn’t pass SPF and DKIM checks.  This should be an iterative process, one that requires slowly increasing restrictions on how email is processed.  Never go straight to reject, you are likely to have legitimate email rejected.

Why would you want to set more restrictive policies?  Third parties with bad sending reputations can affect your email reputation, potentially even causing your legitimate email to be dumped to the spam folder or rejected entirely.  The more you manage the reputation of your senders, the better your reputation and the more likely your email is to be accepted.

MxToolbox is the expert in email delivery, SPF, DKIM and DMARC.  Our team will help you improve your email delivery, give you insight into your legitimate and illegitimate senders, help you set DMARC to improve your email reputation and help you get your message delivered.  Our Delivery Center product gives you everything you need, including access to our expert support team.

DNSSEC Root Zone Key Signing Key (KSK) Rollover

What is it?

The KSK is a public-private key pair that allows the DNSSEC protocol to secure your DNS information. The public part of the key is the starting point for DNSSEC queries similar to how the root servers are the starting point for DNS queries. The private part of the key is used by Verisign to sign the Zone Signing Keys in the DNSSEC-sign of the root zone.

What does that mean?

If you’re not using DNSSEC then you don’t have anything to worry about. DNSSEC is a additional security measure that can be taken to secure your DNS information and verify that your domain is actually yours. If you’re not sure that you’re using DNSSEC then you likely are not using it. You could ask whomever is responsible for your DNS to find out for sure.

If you are using DNSSEC then you will need to create a new key pair and retire your current key pair so that DNSSEC will keep functioning. This will be done automatically for you if you are supporting RFC5011 (https://tools.ietf.org/html/rfc5011). Otherwise, you will need to manually update the trust anchor at http://data.iana.org/root-anchors/ and you can find information about testing your configuration at https://www.icann.org/en/system/files/files/ksk-rollover-external-test-plan-22jul16-en.pdf

MxToolbox Resources

networktools_dns.png

MxToolbox has all the DNS and DNSSEC tools you need to help you through this transition.  We have everything from basic DNS lookups, to DNSKEY, NSEC and IPSECKEY lookups to comprehensive domain research tools, like Investigator.  You can even validate your DNS Cert or HTTPS Certificate.  All of these tools are easily accessible from

our Network Tools page (see image).

Additional Resources:

https://www.icann.org/news/blog/dnssec-rolling-the-root-zone-key-signing-key

https://www.icann.org/resources/pages/ksk-rollover