Email spoofing can harm your corporate brand, decrease open rates for your legitimate email, cause legitimate email to be blocked, compromise website security and even create financial complications. No company is totally immune from malicious email spoofing using their domain, but there are ways to protect yourself. Spoofing comes in a few different forms:
- Simple Domain Spoofing – a spammer sends email that looks like it is from your domain, but originates from a server that you do not control or not in your SPF record.
- Hacked SPF Sender – A spammer hacks a legitimate sender, one listed in your SPF records, and sends email that appears to be from you.
- Hacked Internal Account – A hacker compromises an internal email box and sends email via legitimate sources.
- Similar Domain Spoofing – A spammer sets up a complete domain that has a similar name to yours. For example, “example.com” versus “exarnple.com” or “exampIe.com”.
Recently some fraudsters were brazen enough to attempt to spoof email from MxToolbox.com. This illustrates how our experts (and MxToolbox Delivery Center Product) protect us from fraud and phishing and how we can protect your company too.
DNS Configuration
Good email delivery and protection from fraud and phishing attempts requires expert management of your DNS. Four DNS protocols are particularly important:
- SPF allows you to delegate outbound email to 3rd parties.
- DKIM allows you to crytographically sign email to take ownership of the email you send.
- DMARC provides two very useful features:
- Allows you to designate email addresses to receive feedback on your email delivery.
- Allows you to set an email delivery policy for how inbox providers handle email that isn’t DMARC compliant with either SPF or DKIM.
- BIMI allows you to provide an icon that inbox providers may display if your email passes DMARC with a strict DMARC policy
Our spoofer used IP addresses outside of our SPF so failed SPF checks and DMARC compliance. Additionally, our DMARC policy is set to reject, so inbox providers knew to discard these failed emails immediately. Our expertly configured DNS helped us reduce the impact of this attack on our email delivery, our customers and the non-customers targeted.
You might think that DNS configuration is all you need to protect your email delivery, but there is more.
Visibility
SPF, DKIM and DMARC Passing Rates
While DNS configuration is the most important first step in email deliverability, you need constant visibility into your email delivery status in order to protect your brand. MxToolbox Delivery Center provides important insight into your email delivery posture with real-time statistics on SPF, DKIM and DMARC pass and fail rates across all your email senders, legitimate and fraudulent.
In this case, MxToolbox Experts quickly noticed a spike in email from illegitimate sources. Delivery Center reported this spike by analyzing DMARC reports approximately 24-48 hours before we began to receive bounceback notices from targeted inbox providers. With strict ‘Reject’ DMARC policies in effect, our Expert team could rely on most inbox providers dumping these emails without delivery, however, we needed to analyze the potential risk.
Bounce Analysis
MxToolbox Delivery Center integrates a Bounceback analysis tool that allows us to analyze bounceback email messages from dozens of inbox providers to determine the reason an email failed to make it to the intended recipient.
Bounceback messages can help you understand recent attacks and prevent new ones. For example, a bounceback due to Reverse DNS failure, as above, is an indicator that your spammer was using a server outside of your network and not listed in your SPF as was our recent spammer. Bounceback messages can also provide insight into other reasons for delivery failure, including blacklisting, malware/spam content and more.
Feedback Loops
The newest visibility feature of MxToolbox Delivery Center incorporates Feedback Loops. Feedback Loops allow Inbox Providers to return information from inbox owners to the original senders, including much of the original message header. Analyzing message content and headers returned via feedback loops gives you unique insight into how your email is being perceived by recipients. Did the recipient report you as spam? Was the email actually fraudulent? Was the content yours but appeared spammy? Feedback loops are very powerful and a necessary part of maintaining high quality email delivery.
Get ahead with Delivery Center
To maintain the highest levels of email deliverability, businesses like yours need a proven Email Delivery management system like MxToolbox Delivery Center. Delivery Center provides you with valuable insight into your email delivery posture and the on-going maintenance necessary to maintain peak performance:
- Who is sending email purporting to be from your domain
- What is the reputation of your senders’ IPs
- Geolocation of your senders and What their blacklist reputations are
- How your SPF, DKIM and DMARC setup is performing
- What senders are failing DKIM
- What senders are failing SPF verification
- When to setup more restrictive policies for DMARC
- What on-going maintenance you need to maintain and improve your email deliverability