Monthly Archives: November 2020

DKIM Signature Tags, A Primer

DKIM is a form of email authentication that allows an organization to claim responsibility for a message by signing it in a way that can be validated by the recipient. DKIM Authentication is an important part of DMARC compliance and obtaining the best email deliverability possible for your domain.

DKIM tags are located within the actual DKIM-Signature header data. A tag is typically a single letter followed by an equal sign (=). The value of each DKIM tag denotes a specific piece of intel about the email sender, the message itself, and its public key location.

There are several tags available to an email sender using DKIM, with some being required and some being optional. If a required tag is omitted in the DKIM signature, a verification error with the mailbox provider will occur. Of note, tags included in the DKIM signature that do not have a value assessed are treated as having an empty value. However, tags not included in the DKIM signature are treated as having the default value.

Required DKIM Tags

Below are the required tags of a DKIM-Signature header. Any DKIM signatures missing these tags will produce an error during the verification process.

v= version of DKIM standard being used. The value should always be set to 1.
a= cryptographic algorithm used to generate the signature. The value should be rsa-sha256.
d= domain used with the selector record (s=) to locate the public key. The value is a domain name owned by the sender.
s= selector record name used with the domain to locate the public key in DNS. The value is a name or number created by the sender.
h= list of headers that will be used in the signing algorithm to create the hash found in the b= tag. The order of the headers in the h= tag is the order in which they were presented during DKIM signing; therefore, it is also the order in which they should be presented during verification. The value is a list of header fields that will not change or be removed.
bh= computed hash of the message body. The value is a string of characters representing the hash determined by the hash algorithm.
b= cryptographic signature of the headers listed in the h= tag. This hash is also called the DKIM signature.

Optional DKIM Tags

Recommended

Below are the optional tags that are typically recommended in a DKIM-Signature header. DKIM signatures missing these tags will not produce an error during verification, but they are recommended as a means to help identify spam.

Note: Spammers do not normally set time values. Empty or incorrect time values, such as an expiration time dated before the email timestamp, will cause some mailbox providers to reject the message.

t= DKIM signature timestamp. It is meant to indicate the time the message is sent. The format is the number of seconds from 00:00:00 on January 1, 1970 (UTC).
x= DKIM signature expiration time in the same format as above. The value of this tag must be greater than the value of the timestamp tag if both are used in the DKIM signature. DKIM signatures could be considered invalid if the verification time at the verifier is past the expiration date, so be sure not to set the expiration date too soon.

Not Required

Below are the optional tags that are not required in the DKIM signature.

c= canonicalization algorithm that defines to a mailbox provider what level of modifications may be present as the email is in transit to the mailbox provider. Modifications can include whitespace or line wrapping. Some email servers make minor modifications to the email during transit, which can invalidate the signature.
i= identity of the user or agent. The value is an email address containing the domain or subdomain as defined in the d= tag.

Not Recommended

Below are the optional tags that are not recommended in any DKIM signature.

l= number of characters from the message body that were used to compute the body hash (bh=). If this value is not present, it is assumed the entire message body was used. This tag can be difficult to control and could lead to verification errors.
z= list of the message’s original headers and may differ from the headers listed in the h= tag. This tag may be used by some mailbox providers in the process of diagnosing a verification error. Its value is not well defined.

MxToolbox Delivery Center helps you with DKIM Compliance

To maintain the highest levels of email deliverability using DKIM, businesses like yours need a proven Email Delivery management system like MxToolbox Delivery Center. Delivery Center provides you with valuable insight into your email delivery posture and the ongoing maintenance necessary to maintain peak performance:

Manage SPF, DKIM, and DMARC (and BIMI) to improve compliance and reduce the threat of fraud and phishing using your domain.
Review daily volume and SPF, DKIM, and DMARC compliance rates to ensure the best email deliverability.
Implement Feedback Loops to gain unique information on how your recipients view your emails and when they mark you as spam.
Gradually move your DMARC policy to Reject to enable better inbox placement opportunities.
Manage the on-going requirements of maintaining high levels of email deliverability

Why do you need DMARC?

At MxToolbox, we keep saying “DMARC adoption is imperative for successful delivery of your business email“. Without implementing DMARC, your messages are vulnerable to poor inbox placement, and fraud, phishing and spoofing campaigns. The DMARC standard gives you visibility into who is sending email “from” your domain, including bad actors. And, big Inbox Providers are prioritizing DMARC-compliant email for inbox placement. If you don’t adopt DMARC, you will behind your competitors.

Inbox Provider DMARC Adoption is Increasing

The major Inbox Providers like Google and Yahoo! have supported DMARC for several years. About 80% of the world’s inboxes run DMARC checks on inbound messages, and enforce the domain owner’s DMARC policies. This includes essentially all U.S.-based email providers (Gmail, Yahoo!, Outlook).

In addition, a recent study found the number of email domains that have implemented DMARC has now exceeded the one million mark.¹ This is an increase of over 48% from the previous year, and nearly 2.5 times the number of DMARC records from two years ago. It is now likely that your competitors are adopting DMARC to get better inbox placement and protect their domains against fraud and phishing. It’s time you joined them.

MxToolbox Helps You Adopt DMARC

To maintain the highest levels of email deliverability using DMARC, businesses like yours need a proven Email Delivery management system like MxToolbox Delivery Center. Delivery Center provides you with valuable insight into your email delivery posture and the ongoing maintenance necessary to maintain peak performance:

Manage SPF, DKIM, and DMARC (and BIMI) to improve compliance and reduce the threat of fraud and phishing using your domain.
Review daily volume and SPF, DKIM, and DMARC compliance rates to ensure the best email deliverability.
Implement Feedback Loops to gain unique information on how your recipients view your emails and when they mark you as spam.
Gradually move your DMARC policy to Reject to enable better inbox placement opportunities.
Manage the on-going requirements of maintaining high levels of email deliverability

¹ https://www.valimail.com/resources/email-fraud-landscape-summer-2020/

AMP for Email

What is AMP for email?

Accelerated Mobile Pages (AMP) is a way to provide dynamic email to recipients. This technology combines HTML, CSS, and JavaScript components to deliver engaging content quickly to customers on mobile devices.

In 2015, Google initially released AMP for websites. Four years later, AMP for email was introduced, providing email developers and marketers increased functionality. The technology’s goal is to deliver interactive content within emails that loads promptly to inboxes.

AMP and Gmail

Google and now Gmail is the driving force behind AMP adoption. Before to 2019, if your business considered the AMP email technology, you were limited to Gmail users as targets, which for most marketers is a sizable opportunity. Recently, other email providers have implemented the AMP framework, making it more relevant to business communications. If AMP becomes a standard practice, even more email providers will undoubtedly offer this technology.

AMP is far less constrained than traditional email. Some of the main aspects you can use in AMP emails are discussed below.

Dynamic content

Overall, email content has been static which can make for bland reading. AMP for email changes that practice by displaying dynamic content for more versatile engagement.

Layout

AMP for email opens up the layout of traditional email with elements such as a carousel for media, lightboxes for images and text, and accordions for showing and hiding sections. This aspect lets AMP users upgrade messages to make more impactful experiences.

Media

With AMP, media loads quickly, allowing for better customer experience. AMP for email provides efficiency and speed without compromising design.

Should you adopt AMP?

Although AMP for Email is still being rolled out, it appears to be trending toward implementation by the majority of email providers. While email deliverability is still the biggest factor in getting your message to your customers, AMP for Email could be an interesting technology to leverage once your email is delivered.

MxToolbox and Email Deliverability

To maintain the highest levels of email deliverability, businesses like yours need a proven Email Delivery management system like MxToolbox Delivery Center. Delivery Center provides you with valuable insight into your email delivery posture and the ongoing maintenance necessary to maintain peak performance:

Manage SPF, DKIM, and DMARC (and BIMI) to improve compliance and reduce the threat of fraud and phishing using your domain.
Review daily volume and SPF, DKIM, and DMARC compliance rates to ensure the best email deliverability.
Implement Feedback Loops to gain unique information on how your recipients view your emails and when they mark you as spam.
Gradually move your DMARC policy to Reject to enable better inbox placement opportunities.
Manage the on-going requirements of maintaining high levels of email deliverability

If AMP for Email becomes a standard, expect MxToolbox to add free tools to the site and new features to Deliver Center to help you adopt AMP.

Phishing Risk – Domain Registrars

Email Fraud and Phishing is a huge risk for both consumers and businesses. In 2019, the FBI estimated that people lost over $57M to email fraud and phishing attacks. Fortunately, there are ways to protect yourself and your business.

Inbox Protection

For consumers and businesses, being vigilant in recognizing the potential for fraud and phishing via email is important. The FTC has created good guidelines to help you recognize inbound email phishing and you can read more about recognizing phishing on MxToolbox’s Blog. Unfortunately, people are pretty bad at recognizing phishing emails, so depending on your users to protect your business from phishing scams is not enough, you need technological assistance.

Inbox Provider Protection

Your email inbox provider is trying to protect you from fraud and phishing emails by using DMARC as a decision criteria for inbox placement. DMARC does three important things for email senders:

Obtain feedback on how much of your email is passing SPF, DKIM and DMARC checks
Obtain forensic examples of failed emails
Set a policy for how Inbox Providers handle email that fails DMARC checks

A sender using DMARC is therefore more likely to manage email delivery and less likely to be a source of spam, malware, fraud or phishing. Senders can even instruct Inbox Providers to Reject email that fails DMARC compliance checks. Inbox providers then protect their users from fraud and phishing by prioritizing DMARC compliant email.

Vendor Sender Protection

A Vendor that sets up and maintains DMARC and sends DMARC compliant email will protect its own brand from being used in fraud and phishing emails and protect the recipients of their email. Therefore, it is important to check the DMARC status of any potential vendors.

In this on-going series, MxToolbox will report upon the DMARC status of key service areas. Today:

Domain Registrars – Do they protect their customers from fraud and phishing?

TLDR: Some, not all.

DMARC adoption by the top 30 domain registrars is currently ahead of the Alexa 1000 and the Fortune 500, but not complete. With 30% of Domain Registrars not adopting DMARC yet, there is a lot of room for improvement. In addition, only 21% of Domain Registrars have adopted strict Reject DMARC policies to protect their customers from fraud and phishing attempts using the registrars domain.

The Risk

If a Domain Registrar has not adopted DMARC and more secure DMARC Reject policies, the risk of their domain being used in fraud and phishing emails is particularly high. If a single email slips through your mental filter, a fraudster could gain your legitimate credentials to your domain registrar and make potentially fatal changes to your domain setup. For example:

Redirecting traffic from your website to theirs
Setting up a phishing website in a subdomain of your own domain to gain your customers information
Changing your SPF record to include their IP addresses to further the email phishing scam
All of the above.

Domain Registrars are a critical component of e-commerce. If they are not protecting themselves from being used in fraud and phishing attacks, they put their customer businesses at risk.

The Solution

There are a few simple ways to protect your business from fraud and phishing by vendors:

Check any vendor you do business with for a DMARC record.
Prioritize vendors with DMARC policies set to Reject.
If you are tied to a vendor who has not adopted DMARC, it’s time to pressure them to do so.
Adopt DMARC for your own email communications.

How can you adopt DMARC?

Adopting DMARC is a multi-step process requires on-going management.

Setup SPF record to include all your known senders
Setup DKIM signatures at all your known senders
Create a DMARC record to get feedback on your email
Identify new legitimate sources of email from the DMARC reports and add them to your SPF and DKIM setups
Identify fraud and phishing from DMARC reports and warn your users and email recipients.
Gradually adopt restrictive policies once you have identified all legitimate sources of email using your domain name

Repeat steps 4 and 5 regularly as you may add and remove systems and vendors that send email on behalf of your domain. In addition, DMARC reports can be difficult to read, particularly when you have a large volume of email. Investing in a partner to help you on your DMARC journey is important.

MxToolbox Delivery Center

Manage SPF, DKIM, and DMARC (and BIMI) to improve compliance and reduce the threat of fraud and phishing using your domain.
Review daily volume and SPF, DKIM, and DMARC compliance rates to ensure the best email deliverability.
Implement Feedback Loops to gain unique information on how your recipients view your emails and when they mark you as spam.
Gradually move your DMARC policy to Reject to enable better inbox placement opportunities.
Manage the on-going requirements of maintaining high levels of email deliverability

The State of Government Email Delivery

Recently the CDC found itself in the awkward position of advising the public on email fraud and phishing. The reason: COVID contact tracing efforts have been thwarted by fraudulent email from professional phishing groups. Email phishing and email delivery are a systemic problem for governments and businesses alike.

As more federal, state and local agencies move online they generate more email to their constituents and users. Whether you are receiving confirmation on your recent driver’s license renewal or setting up a meeting about property taxes, ensuring the email reaches your inbox is a major concern. Unfortunately, the majority of American governmental agencies are poorly positioned to deliver email.

Blacklisting

Inbox providers use blacklists to filter incoming email. Email from IP addresses of a blacklist or containing Domain names on blacklists will be blocked or thrown into the Spam or Junk folders.

Unfortunately, on average 3.3% of government domains are blacklisted, meaning that their email is in jeopardy of being blocked.

Agency	Blacklist %
City	3.8%
County	3.8%
Federal Agency – Executive	1.1%
Federal Agency – Judicial	0.0%
Federal Agency – Legislative	4.4%
State	3.3%

City, County and State governments represent the majority of government domains and the highest percentage of blacklisted agencies, excluding the Legislative branch of the Federal government. This puts email correspondence with these smaller agencies in jeopardy.

SPF

SPF is a technology that allows a domain to designate a list of IP addresses or domains as legitimate senders on behalf of that domain. For example, your company could use MailChimps or SalesForce to send email to marketing and sales customers. SPF allows you to designate those two companies as valid senders and only these domains. Anyone else trying to send email using your domain would fail the SPF checks that inbox providers run on incoming email. A failed SPF check means that the email may be blocked or dumped to the Spam or Junk folders.

Agency Type	% SPF
City	72.7%
County	70.1%
Federal Agency – Executive	93.9%
Federal Agency – Judicial	73.9%
Federal Agency – Legislative	22.8%
State	40.1%

MxToolbox’s survey clearly shows that State and Legislative Agencies are failing to adequately use SPF to protect their email delivery. While City and County agencies fare slightly better, SPF adoption is required to get email to the inbox. Without SPF, anyone can attempt to send email that appears to come from a government agency, creating the potential for fraud and phishing using that agency’s domain name.

The lone bright spot in our survey is the Executive Branch of Federal government. The nearly 94% adoption of SPF reflects the Department of Homeland Security’s requirement to fully adopt DMARC by October of 2018 (SPF is a key component of DMARC). While some departments are behind, the DHS directive has definitely been successful. All US agencies need to make adopting SPF, and DMARC a priority to improve email delivery and protect their recipients from fraud and phishing using government domains.

DMARC

DMARC is a standard that allows a domain owner to do several things:

Assign email addresses to be used for feedback from inbox providers regarding SPF, DKIM and DMARC compliance.
Assign email addresses to be used for forensic samples of emails that fail SPF, DKIM or DMARC compliance.
Set a Policy for how Inbox Providers should handle email from the domain that fails SPF, DKIM or DMARC compliance. Policy options are:
- None – Do nothing
- Quarantine – Set the email aside in a Quarantine type folder. Sometimes this is a Spam or Junk folder, sometimes this gets placed in a Quarantine spot the administrator can examine.
- Reject – Dump the email to trash. A reject policy is required by the Department of Homeland Security and to use the BIMI image standard.
Specify a % of email to obey the Policy. The rest will be treated as in a None policy.

		Policy as a % of DMARC	% ofDomains
Agency Type	% DMARC	None	Quarantine	Reject	Reject
City	13.1%	56.6%	24.5%	13.8%	1.8%
County	20.7%	52.8%	25.8%	19.7%	4.1%
Federal Agency – Executive	90.4%	2.8%	1.4%	93.6%	84.6%
Federal Agency – Judicial	17.4%	50.0%	25.0%	25.0%	4.3%
Federal Agency – Legislative	13.2%	40.0%	13.3%	46.7%	6.1%
State	12.0%	57.4%	14.0%	24.0%	2.9%

The Executive Branch with 90% DMARC adoption is well out in the lead, again owing to Department of Homeland Security requirements. Unfortunately, all other agencies are dangerously behind, risking their email deliverability. In our recent case studies, we found that improving DMARC compliance can dramatically improve email open rates and click through rates. If government agencies want to connect with constituents, they need to adopt DMARC as soon as possible.

Fraud and Phishing Protection

Ultimately, to protect your recipients from Fraud and Phishing using your domain, you need to adopt a strict Reject DMARC policy. A Reject policy tells the inbox provider to completely reject email that does not pass SPF, DKIM and DMARC checks. Unless they gain access to your servers or the servers of your legitimate senders, fraudsters’ emails will be blocked by a DMARC Reject policy. While getting to a DMARC Reject policy requires careful management and attention to prevent legitimate email from being blocked, the benefit of protecting your email, your brand and your customers outweighs the complexity and cost.

Taken as a whole, Government agencies are woefully inadequate in their support for DMARC reject policies and guarding their email from fraud and phishing. Particularly troubling are the state, county and city governments with low single digit support. Government agencies need to be a trusted source of information. Unfortunately, with their current DMARC configurations, the domains of government agencies are at tremendous risk of being used in fraud and phishing attacks.

How can you or governments adopt DMARC?

Any domain owner must adopt SPF and DMARC immediately. When adopting DMARC, it pays to invest in an email delivery management platform that can help you analyze your email senders, manage the quality of your senders and help you obtain a DMARC Reject policy that does not limit legitimate email. Without analyzing the SPF, DKIM and DMARC compliance of your email, both legitimate and fraudulent, you will not be able to protect your email deliverability.

MxToolbox Delivery Center

Manage SPF, DKIM, and DMARC (and BIMI) to improve compliance and reduce the threat of fraud and phishing using your domain.
Review daily volume and SPF, DKIM, and DMARC compliance rates to ensure the best email deliverability.
Implement Feedback Loops to gain unique information on how your recipients view your emails and when they mark you as spam.
Gradually move your DMARC policy to Reject to enable better inbox placement opportunities.
Manage the on-going requirements of maintaining high levels of email deliverability