Category Archives: Blacklists

Do you know what you don’t know about your email?

As a marketer, I typically know if a prospect opens my email, clicks on a link or buys a product. All 3rd party email marketing tools provide this information. But, what happened before the Open?

Did the email make it to the Inbox?

Did it get delivered to the Spam or Junk folder?

Does my language, text, grammar or content seem spammy?

Did my email configuration affect my open rates?

Are my 3rd party senders blacklisted or otherwise hurting me?

Are my prospects complaining about me to their Inbox Providers?

There are many layers protecting inboxes from spam and undesired email. Your business needs a strategy to ensure that your email passes through each layer to reach the recipient. Your open rates will thank you.

What can you measure?

Actually, with the right tools, you can get answers to all these questions. Inbox Providers like Google, Yahoo!, and Office365 wants their inboxes to show relevant email so they provide data via DMARC Reports and Feedback Loops to help legitimate businesses. Neglecting these key resources is equivalent to driving in traffic without a GPS: you don’t know what traffic incidents or twists and turns are waiting for you.

How does MxToolbox Help?

Inbox Placement

Will your email make the Inbox, Junk folder, Spam folder or fail to get delivered?

Inbox Placement allows you to test prospective campaigns with the most common Inbox Providers – Google, Yahoo! and Office365.com. We’ll tell you if the email is delivered and to what folder. We’ll even analyze the contents of your email to give you MxTips(™) to improve your inbox placement. Some simple tweaks to verbiage or construction can often improve Inbox Placement tremendously.

DMARC Reporting

Is your email configuration affecting your email delivery? Are all your emails SPF, DKIM and DMARC compliant?

To optimize your email delivery, and get your message heard, you need to constantly analyze and manage your email configuration. Inbox Providers will send out DMARC digests giving you data on your SPF, DKIM and DMARC pass rates. With this data, you can determine if you have senders missing from your SPF records, DKIM issues, or potential risks from fraud and spoofing. MxToolbox Delivery Center gives you all the tools you need to take DMARC data and turn it into actionable email delivery insight.

Feedback Loops

Did a recipient complain about receiving your email to their Inbox Provider? Did the recipient mark it as unsubscribed with the Inbox Provider? Was the email address invalid or shut down?

Many Inbox Providers offer feedback loops or complaint mechanisms to validated emailers. Once configured, you can get information on email addresses and campaigns and how recipients view your emails. Analyze your recipient complaints, remove complainers, unsubscribers, and closed email boxes to massively improve your email delivery. MxToolbox Delivery Center allows you to configure and aggregate complaints across Inbox Providers to get insight into how your campaigns are perceived by recipients.

Adaptive Blacklist Monitoring

Are your 3rd party ESPs blacklisted and harming your email delivery?

Due to the nature of their business, 3rd party emailers will always have a few IP addresses blacklisted and it is probable that some portion of your email will be sent from a blacklisted IP address. This only becomes an issue when a significant amount of your email from that provider is sent from blacklisted IP addresses. MxToolbox Delivery Center included Adaptive Blacklist monitoring to detect, via DMARC, the IP addresses being used to send your email and analyze the blacklist status of the IP when the email was sent. You’ll know if your 3rd party ESP is helping or harming your email delivery.

Are Blacklists still relevant?

Blacklists were developed as a way to mark IP addresses used to send spam, IP addresses at risk of sending spam due to poor configuration or domains used in spam emails. Blacklists would be consulted by an inbox owner when making email delivery decisions and should not be used to modify web traffic.

The Arms Race

Early on spammers could set up an email server on any network and send unsolicited email to whatever email addresses they could scrape off the Internet. Inbox Providers and other Companies then set up lists of IP addresses that were sending spam and shared them with each other – the first blocklist/blacklists came from these casually developed lists. Eventually, blacklist providers emerged as a profitable business model and even developed traps to harvest the IP addresses of spammers without impacting actual users. Blacklists became highly useful to block malicious email from a single email-sending IP address or small network.

Spammers could see the inevitable downturn in their scams and quickly changed IP addresses to resume sending spam. Blacklists detected the new spam IP address, listed it and Inbox Providers blocked email from it. This cycle continued. Some Blacklists started listing entire networks and Internet Service Providers to stop them facilitating spam. The downside is that legitimate senders can get caught in this cycle, but often have trouble changing IP addresses. Delisting is available but sometimes time-consuming which delays or degrades regular business operations.

Legitimate Email Marketing Can Be Blocked

Email marketing became a necessity to get a business growing on the Internet. Setting up a mail server, maintaining it and keeping it off of a blacklist with any sort of email volume was difficult for smaller businesses. Large companies could easily afford a big pool of IP addresses and several mail servers to shift load around. Entrepreneurs stepped in and created email marketing/email blasting companies to fill the gap. Email marketing firms took on the risk of blacklisting and the responsibility of moving the load around, as well as getting the IP addresses delisted in a timely manner. But, which emailers were legitimate and which were spammers? SPF, Sender Policy Framework, allowed businesses to designate an email marketing company as a legitimate partner.

New Technologies Emerge

Inbox Providers then changed the game, scanning for SPF to ensure legitimate outsourcing. Most companies will not process an email if it does not pass SPF Authentication or SPF Alignment. The next step was checking digital signatures using DKIM and tying it all together with DMARC. This created a big bar to jump for many spammers, but also businesses. An email needs to pass SPF or DKIM checks to be DMARC compliant and a sender needs to actively manage email configurations to get an email delivered. A comprehensive email delivery tool like MxToolbox Delivery Center has become a necessity for understanding DMARC reports, managing configurations and maintaining good email delivery.

Spammers are beginning to adapt by hacking legitimate business email accounts or adopting SPF, DKIM and DMARC for their look-alike spam domains. Unfortunately, small businesses are still lagging behind and their email delivery is suffering. SPF, DKIM and DMARC have become the minimum for good email delivery,

So, are Blacklists Still Relevant?

Blacklists are less important than they were in the past. You should think of email security as layers on an onion:

Blacklists
SPF
DKIM
DMARC
Internal Filters
Relevance Filters

If being on a blacklist is affecting your business, your email isn’t even making the first layer of security and you’ve failed to take advantage of all the tools you have available to manage your email deliverability. Being blacklisted is like a heart attack, it’s a sign that you need to rethink everything, change your email practices and adapt to the new technology landscape.

Ultimately, blacklists may only be useful for on-premise email hosts and will lose some relevance, especially for Inbox Providers like Google, Yahoo! and Office365. Blacklists are brute-force and can eliminate legitimate, relevant email when blocking spam. There are many more layers to jump through before you get to the Inbox that are easier for Inbox Providers to maintain and more effective at blocking undesired email and passing legitimate useful communications. All businesses need to adopt the current email best practices: 3rd party email senders, setting up SPF, DKIM, DMARC, leveraging DMARC Reporting, etc.

How can MxToolbox help?

Get started with Inbox Placement! Your goal is to get to the Inbox, so start there. We’ll analyze your email configuration and content to give you clear reasons why your campaigns aren’t making it and make recommendations to help you get there. MxToolbox Delivery Center also provides deep insight into DMARC, SPF and DKIM configurations and allows you to obtain feedback on recipient complaints, DMARC reports and emerging email threats. Get comprehensive insight into your email delivery with Delivery Center.

Recent Spikes on UCEPROTECT Level 3

Recently, we noticed an increase of in the number of ASNs (full blocks of IP addresses owned by individual Internet Providers) listed by UCEPROTECT on their Level 3, aka Draconic, blacklist. The purpose of this particular UCEPROTECT blacklist is to block ASNs that allow spam to be sent from a large number of IP addresses in the network, often these are ASNs setup for spam or providers that do not adequately police their customers. However, this includes many popular services so many legitimate businesses have also been affected.

MxToolbox Stance

We provide Blacklist lookups for information purposes only. DO NOT make decisions exclusively based upon a listing on the Blacklists we check. MxToolbox is not blocking you, the Inbox Provider is blocking your email because your IP address or domain is listed on a blacklist that they are using to make email delivery decisions. We give you the opportunity to see who is listing your IP address and do not endorse any blacklist. Feel free to ignore a blacklist if you think it is not relevant.
NEVER PAY to be delisted. Legitimate blacklists, including UCEPROTECT, have free ways to be delisted. In this case, the entire ASN should be automatically delisted when the UCEPROTECT SPAMSCORE for that ASN drops below a certain level in a 7 day moving average. You can learn more about how UCEPROTECT lists ASNs here.
MxToolbox regularly reevaluates the list of blacklists we check. Our criteria requires the blacklist to be used to make email delivery decisions. We have noted that some companies are dropping UCEPROTECT from their decision criteria due to the recent activity. We will watch this issue but will also continue to show UCEPROTECT listings as long as they are being used for email delivery decisions.

What you can do if you are blacklisted

We know that being on a blacklist is affecting your business. Be patient! Blacklists are not out there to attack your legitimate email, they are there to protect everyone from spam and phishing attempts. They make money by being relevant to email delivery decisions and sometimes they get over zealous.

Take the opportunity to evaluate your email sending configuration, blacklists are not the only reason your email is failing to make the inbox.

Are you still hosting your own email? This could be an opportunity to investigate Inbox Providers that have improved spam filtering and email sending capabilities. It is easier to have all of your email blocked by a blacklisting event if you are sending from a single IP address or small block.
Are you using multiple 3rd party email providers? You should evaluate their performance and make sure each of them is in your SPF record and no one else.
Adopt DMARC. DMARC compliant email is now a requirement to get into the inbox at Google, Yahoo! and Outlook.com/Office365. If much of your email is non-compliant, you may be blocked entirely. Adopt DMARC to get information on your outbound email to become DMARC compliant or be left behind by your competitors who are.
Use a DMARC delivery tool. Inbox Providers give you information on your email senders, including spammers pretending to be you. You need a tool that can aggregate and analyze your email delivery posture using DMARC to improve your email configuration and block the spammers. MxToolbox Delivery Center was designed to make email delivery simpler by highlighting improvements to your email deliverability.

Is Email Secure?

Yes and No. Email is a highly valuable tool that has evolved to be more secure, but there are still ways to exploit email for nefarious purposes. Email users should be careful with how they use email and the emails they respond to. Let’s look at email security in more detail.

A Little History

Electronic mail originated on the early experimental Arpanet, the precursor to the Internet. At that point, all the interconnected servers were within high-security facilities. Since the security was on the outside, researchers did not consider protocol security; everything was sent in clear text – HTTP for browsing documents, FTP for sharing data files, and SMTP for electronic communications. When the Arpanet opened up to universities and then to businesses and private users, those same protocols were still transmitting data and passwords in clear text. Unfortunately, clear text communications are susceptible to man-in-the-middle attacks – corrupted computers or routers between the two computers in communication.

The early Internet was not secure, so new technologies were developed to improve security:

HTTPS to secure online transactions involving credit cards
SFTP to secure file transfers (now replace by HTTPS in many cases)
TLS to encrypt email communications between email servers

With the adoption of TLS, Transport Layer Security, email was secured from potential man-in-the-middle attacks. However, there are other ways to exploit email.

Alternate Technologies

There were other technologies that attempted to “secure” email communications, all had various degrees of success, but none of them have really gone mainstream.

PGP, or Pretty Good Privacy, used a Public-Private encryption key system to encrypt and decrypt email. Email was completely secure in transit, and from administrators, but unfortunately, PGP was bulky to use. TLS solved the problem of securing communication between servers without the user needing to do anything.
“Secure” Email Servers are web servers where communication could be secured behind a password protected web login. It was not really email but a way to communicate in an email-like fashion. You often see these secure communications websites with Legal and Medical professions, but they suffer from bulky interfaces and the inconvenience of going somewhere other than your normal email applications to view the communication.
Sender Verification Services respond to an unsolicited email with an email demanding the sender verify their identity. The goal here is to reduce the potential for spam and phishing attempts by creating a hurdle for senders to jump. The inbox provider then only passes on “verified” email to the user. This technique essentially removes any automated email, including newsletters, as marketing teams are unable to monitor the verification email. The downside is that a legitimate sender may not register so you miss important email.

The Threat of Spam and Phishing

Email is the #1 preferred method for perpetrating online scams. The marginal cost of sending an email is negligible and the rewards for a successful scam can be thousands or millions of dollars. According to Cisco, approximately 84% of all email is spam, much of which is phishing scams and much also escaping spam filters. By that measure, email is not “secure”.

“Securing” Email

Improving email security is not a single technology or vendor but involves changing business processes, adopting new standards and continuously adapting to the ever-evolving landscape of email scams. Some recommendations:

Stop hosting your own email – Inbox providers like Gmail, Office365, Yahoo!, etc. have dedicated teams to managing and blocking spam and phishing. Most businesses would benefit by leveraging these external experts and outsourcing email inbox services.
Turn on 2-factor authentication – Securing email communication, both sending and receiving, means securing access to email accounts. 2-Factor Authentication helps make email more secure.
Invest in Spam and Phishing Awareness Training – Email scams exploit human weakness through social engineering to gain access to your email, bank accounts and secure data. Training your team to recognize these scams will improve your email security.
Leverage DMARC and supporting technologies – SPF, DKIM, DMARC and BIMI work hand-in-hand to 1) declare who can send email on behalf of a domain, 2) digitally sign email from that domain, 3) report compliance to the sending domain, and 4) apply a corporate logo to compliant email. When a domain leverages these technologies, it is secured against being used in spam and phishing attempts and gives the recipients peace-of-mind that the email is genuine.

To maintain the highest levels of email deliverability using DMARC, businesses like yours need a proven Email Delivery management system like MxToolbox Delivery Center. Delivery Center provides you with valuable insight into your email delivery posture and the ongoing maintenance necessary to maintain peak performance:

Manage SPF, DKIM, and DMARC (and BIMI) to improve compliance and reduce the threat of fraud and phishing using your domain.
Review daily volume and SPF, DKIM, and DMARC compliance rates to ensure the best email deliverability.
Implement Feedback Loops to gain unique information on how your recipients view your emails and when they mark you as spam.
Gradually move your DMARC policy to Reject to enable better inbox placement opportunities.
Manage the on-going requirements of maintaining high levels of email deliverability

On-Premise Email Security Best Practices

If your company strategy requires on-premise email management, then there are some best practices you can adopt:

Use Inbound Email filtering gateways – Out of the box inbound filtering either software or hardware will block most threats using threat detection algorithms. Basic gateways block blacklisted senders. More advanced options allow you to write your own acceptance policies.
Create Advanced Acceptance Policies – Your business is unique. Threats come in many forms. Maybe you want to filter all incoming image files or executables or maybe eliminate objectionable terms associated with risks. Sophisticated algorithms might help protect your business.
Accept only DMARC compliant email – One great idea that Google has pioneered is prioritizing DMARC compliant email. If you do the same, you dramatically reduce the potential for fraud and phishing emails making it to your users.
Setup Outbound Email filters – You do not want to become a source of spam, so setting up filters to control outbound email will reduce the risk of being blacklisted or of sending spam emails within your network.
Setup Advanced Outbound Policies – Advanced policies could include forcing the legal team to encrypt all outbound email or prevent emailing large files, executables, etc. Leveraging advanced policies will help make using email more secure.
Setup DMARC for all outbound email sources – Adopting DMARC for all your outbound email sources will help you protect your sending reputation and reduce the risk of your domain names being used in spam.
Invest in Spam and Phishing Awareness Training – As mentioned above, when employees are trained to recognize spam and phishing attempts, they are less likely to click on dubious links in spam and phishing attempts or click on and install malware.

While email was not initially designed with security in mind, new technologies are improving the security posture of email. Adopting these as they arise makes your business more secure and protects your users, clients and partners.

Inbox Provider Insider Junk Scams

Inbox Providers work hard to stop email fraud and phishing scams from outside. Google, Yahoo! and Office365.com all utilize a mix of algorithms that include Blacklists, SPF, DKIM and DMARC compliance, Spam scoring and Relevance scoring to make inbox placement decisions. However, scammers have found an interesting loophole, by sending the spam from the Inbox Providers servers.

How does an Insider Scam work?

The trick to sending spammy email from within an Inbox Provider’s network is first to compromise an existing email box on the provider’s servers. This can be surprisingly easy! Google, Yahoo! and Office365.com have Millions of users. Corrupt one email box and a spammer can easily send email to every user on every domain that uses the Inbox Provider’s network. For example:

An email from a corrupted Gmail account never leaves the Gmail network when sent to Gmail Inboxes so the email may skip other Gmail spam safeguards like content scanning and Junk/Spam folder analysis.
An email sent from a Gmail account passes Blacklist, SPF, DKIM and DMARC for every domain using Gmail to send email, including emails sent outside the Gmail network, giving these emails a level of trust. A corrupted Gmail account therefore has the clout of Gmail behind it.

Inbox Providers have traditionally looked at Spam and Phishing as an external threat. With the transition of email from on-premise to cloud-based solutions, internal threats with compromised accounts will force Inbox Providers to change and adopt Internal Spam and Phishing analysis algorithms.

What can you do to protect your users?

You email users need to be aware that incoming email cannot be 100% trusted, even when using a reputable Inbox Provider. Invest in Fraud and Phishing training for your staff will raise awareness and help break some of the apathy with regard to security. Read up on more ways to recognize and combat Fraud and Phishing in our previous blog entry.

What can you do to protect your outbound email?

If you are not monitoring the quality of your outbound email, you are at risk for accidentally sending Fraud and Phishing emails from your Inbox Provider and other email sources. Every business should be monitoring Blacklisting, and SPF, DKIM and DMARC compliance from all email sources. With DMARC reporting, you receive feedback on how much of your email is passing SPF, DKIM and DMARC compliance to know how likely your email will make it to the Inbox of your recipients. MxToolbox Delivery Center provides all the information you need on email from your domain.

However, DMARC reporting and Strict DMARC policies will not prevent an Inbox Provider Insider attack using your domain name. For that, you need to use another feature of MxToolbox Delivery Center, Feedback Loops. Feedback Loops provide direct feedback from email recipients at different Inbox Providers on how each recipient views the email they received from you – Did it look like Spam, Phishing or Unsolicited Email? Did they unsubscribe?

Soon, Inbox Providers will implement algorithms to protect their users, scammers will find new ways to exploit your users and your domain for their own gain. In the meantime, beware the Inbox Provider Insider scams.

The State of Government Email Delivery

Recently the CDC found itself in the awkward position of advising the public on email fraud and phishing. The reason: COVID contact tracing efforts have been thwarted by fraudulent email from professional phishing groups. Email phishing and email delivery are a systemic problem for governments and businesses alike.

As more federal, state and local agencies move online they generate more email to their constituents and users. Whether you are receiving confirmation on your recent driver’s license renewal or setting up a meeting about property taxes, ensuring the email reaches your inbox is a major concern. Unfortunately, the majority of American governmental agencies are poorly positioned to deliver email.

Blacklisting

Inbox providers use blacklists to filter incoming email. Email from IP addresses of a blacklist or containing Domain names on blacklists will be blocked or thrown into the Spam or Junk folders.

Unfortunately, on average 3.3% of government domains are blacklisted, meaning that their email is in jeopardy of being blocked.

Agency	Blacklist %
City	3.8%
County	3.8%
Federal Agency – Executive	1.1%
Federal Agency – Judicial	0.0%
Federal Agency – Legislative	4.4%
State	3.3%

City, County and State governments represent the majority of government domains and the highest percentage of blacklisted agencies, excluding the Legislative branch of the Federal government. This puts email correspondence with these smaller agencies in jeopardy.

SPF

SPF is a technology that allows a domain to designate a list of IP addresses or domains as legitimate senders on behalf of that domain. For example, your company could use MailChimps or SalesForce to send email to marketing and sales customers. SPF allows you to designate those two companies as valid senders and only these domains. Anyone else trying to send email using your domain would fail the SPF checks that inbox providers run on incoming email. A failed SPF check means that the email may be blocked or dumped to the Spam or Junk folders.

Agency Type	% SPF
City	72.7%
County	70.1%
Federal Agency – Executive	93.9%
Federal Agency – Judicial	73.9%
Federal Agency – Legislative	22.8%
State	40.1%

MxToolbox’s survey clearly shows that State and Legislative Agencies are failing to adequately use SPF to protect their email delivery. While City and County agencies fare slightly better, SPF adoption is required to get email to the inbox. Without SPF, anyone can attempt to send email that appears to come from a government agency, creating the potential for fraud and phishing using that agency’s domain name.

The lone bright spot in our survey is the Executive Branch of Federal government. The nearly 94% adoption of SPF reflects the Department of Homeland Security’s requirement to fully adopt DMARC by October of 2018 (SPF is a key component of DMARC). While some departments are behind, the DHS directive has definitely been successful. All US agencies need to make adopting SPF, and DMARC a priority to improve email delivery and protect their recipients from fraud and phishing using government domains.

DMARC

DMARC is a standard that allows a domain owner to do several things:

Assign email addresses to be used for feedback from inbox providers regarding SPF, DKIM and DMARC compliance.
Assign email addresses to be used for forensic samples of emails that fail SPF, DKIM or DMARC compliance.
Set a Policy for how Inbox Providers should handle email from the domain that fails SPF, DKIM or DMARC compliance. Policy options are:
- None – Do nothing
- Quarantine – Set the email aside in a Quarantine type folder. Sometimes this is a Spam or Junk folder, sometimes this gets placed in a Quarantine spot the administrator can examine.
- Reject – Dump the email to trash. A reject policy is required by the Department of Homeland Security and to use the BIMI image standard.
Specify a % of email to obey the Policy. The rest will be treated as in a None policy.

		Policy as a % of DMARC	% ofDomains
Agency Type	% DMARC	None	Quarantine	Reject	Reject
City	13.1%	56.6%	24.5%	13.8%	1.8%
County	20.7%	52.8%	25.8%	19.7%	4.1%
Federal Agency – Executive	90.4%	2.8%	1.4%	93.6%	84.6%
Federal Agency – Judicial	17.4%	50.0%	25.0%	25.0%	4.3%
Federal Agency – Legislative	13.2%	40.0%	13.3%	46.7%	6.1%
State	12.0%	57.4%	14.0%	24.0%	2.9%

The Executive Branch with 90% DMARC adoption is well out in the lead, again owing to Department of Homeland Security requirements. Unfortunately, all other agencies are dangerously behind, risking their email deliverability. In our recent case studies, we found that improving DMARC compliance can dramatically improve email open rates and click through rates. If government agencies want to connect with constituents, they need to adopt DMARC as soon as possible.

Fraud and Phishing Protection

Ultimately, to protect your recipients from Fraud and Phishing using your domain, you need to adopt a strict Reject DMARC policy. A Reject policy tells the inbox provider to completely reject email that does not pass SPF, DKIM and DMARC checks. Unless they gain access to your servers or the servers of your legitimate senders, fraudsters’ emails will be blocked by a DMARC Reject policy. While getting to a DMARC Reject policy requires careful management and attention to prevent legitimate email from being blocked, the benefit of protecting your email, your brand and your customers outweighs the complexity and cost.

Taken as a whole, Government agencies are woefully inadequate in their support for DMARC reject policies and guarding their email from fraud and phishing. Particularly troubling are the state, county and city governments with low single digit support. Government agencies need to be a trusted source of information. Unfortunately, with their current DMARC configurations, the domains of government agencies are at tremendous risk of being used in fraud and phishing attacks.

How can you or governments adopt DMARC?

Any domain owner must adopt SPF and DMARC immediately. When adopting DMARC, it pays to invest in an email delivery management platform that can help you analyze your email senders, manage the quality of your senders and help you obtain a DMARC Reject policy that does not limit legitimate email. Without analyzing the SPF, DKIM and DMARC compliance of your email, both legitimate and fraudulent, you will not be able to protect your email deliverability.

MxToolbox Delivery Center

To maintain the highest levels of email deliverability, businesses like yours need a proven Email Delivery management system like MxToolbox Delivery Center. Delivery Center provides you with valuable insight into your email delivery posture and the ongoing maintenance necessary to maintain peak performance:

Manage SPF, DKIM, and DMARC (and BIMI) to improve compliance and reduce the threat of fraud and phishing using your domain.
Review daily volume and SPF, DKIM, and DMARC compliance rates to ensure the best email deliverability.
Implement Feedback Loops to gain unique information on how your recipients view your emails and when they mark you as spam.
Gradually move your DMARC policy to Reject to enable better inbox placement opportunities.
Manage the on-going requirements of maintaining high levels of email deliverability

Blacklisted? Get DMARC

Blacklisting is the oldest form of spam protection. Inbox Providers keep a list of IP addresses and domains that recently sent spam and block them from the inbox. Blacklisting eventually evolved to include 3rd parties maintaining and selling blacklists derived from spam traps, honey pots, and lists gathered from multiple inbox providers. As an email sender, being blacklisted is a sign that you are not adequately managing your email delivery posture. But, blacklisting is not the only way Inbox Providers protect their users from spam. Increasingly, Inbox Providers are using technologies like SPF, DKIM and DMARC to make inbox delivery decisions.

DMARC Helps Prevent Blacklisting

Your IP addresses and Domain can be blacklisted for many reasons:

Spam appears to be coming from your IP addresses or Domain
Sending too much email from a single IP address
Sending email from an IP address that also sends spam
Email recipients marking too much email from your Domain as spam
Improper Forwarding
Domain included in Fraud and Phishing emails
Using spammy wording in your email content

With the right DMARC setup, you can almost completely block spammers from spoofing your domain, or using it in spam, fraud and phishing emails. Adopting DMARC would then eliminate three reasons why your Domain could be blacklisted, dramatically improving your email delivery posture and helping you get your business message to your intended audience.

DMARC Might be More Important than Blacklisting

Blacklisting was once the first line of defense. Now, Inbox Providers are increasingly using more complex algorithms to determine the quality of the email they deliver to inboxes. These algorithms weigh content, blacklisting, DMARC and other factors to determine placement in the Inbox, Junk/Bulk/Spam Folder or simply dump the email entirely. In the new algorithms, DMARC configuration might weigh more heavily than Blacklisting.

Since DMARC depends upon two other technologies, SPF and DKIM, DMARC setup requires more time and attention to setup. This means your team cares about email delivery management and is more active in the management process. Inbox providers like Gmail, Yahoo! and Outlook.com have begun to prioritize DMARC compliant email.

Blacklists are simple and fallible. A legitimate email can put a company on a blacklist if it falls into a honey pot or gets reported as spam by enough email recipients. In addition, many companies use 3rd party emailers with large IP address blocks. These mass emailers rotate through the IP addresses when sending email for all their clients. Not only could your email be sent from the same IP address as many other businesses, but that IP address could be blacklisted because of the other companies’ content. Inbox Providers know the limitations to blacklisting and the benefits of DMARC and their proprietary algorithms reflect this, making DMARC adoption a business requirement. Even if you are blacklisted, DMARC can help you reach the inbox.

How does DMARC work?

Adopting DMARC gives you the ability to do three important things:

Get feedback on how much of your email is passing SPF, DKIM and DMARC checks
Get forensic examples of failed emails
Set a policy for how Inbox Providers handle email that fails DMARC checks

Feedback on email allows you to identify SPF and DKIM configuration issues with legitimate senders, improve these configurations and identify illegitimate senders which may be fraud or phishing threats. Once you have corrected your configuration issues for legitimate email senders, you can change your DMARC policy to instruct Inbox Providers to Reject email that fails SPF, DKIM and DMARC checks. DMARC Reject policies give Inbox Providers comfort that you are actively managing your outbound email.

MxToolbox Delivery Center

Manage SPF, DKIM, and DMARC (and BIMI) to improve compliance and reduce the threat of fraud and phishing using your domain.
Review daily volume and SPF, DKIM, and DMARC compliance rates to ensure the best email deliverability.
Implement Feedback Loops to gain unique information on how your recipients view your emails and when they mark you as spam.
Gradually move your DMARC policy to Reject to enable better inbox placement opportunities.

Email Deliverability in the Travel Industry

Traveling is one of the most enjoyable experiences a person can have and is a widely popular leisure activity. Travel is also a risky endeavor, requiring careful planning and sometimes last minute itinerary changes especially in business travel. Lodging and airfare are typically the most expensive pieces of the budget, so you want partners you can depend upon to inform you of confirmations and itinerary changes in a timely manner. But, can you trust the emails that come from these airline partners?

DMARC Creates Trusted Senders

DMARC is a requirement for trusted email communication. An email from a sender with DMARC properly configured to a strict “Reject” policy can be trusted. Without a “reject” policy, a sending company could easily be spoofed by a fraudster and have that email accepted by inbox providers. Adopting DMARC protects the email recipient and the corporate brand.

DMARC Adoption in the Airline Industry

Trusting email correspondence from your airline is an important part of enjoying your travel experience. If an airline domain can be easily compromised by fraudsters, your travel plans are at risk. Unfortunately, email hygiene and DMARC adoption rates are low among airlines.

MxToolbox’s September 2020 study uncovered the following concerns about airlines ability to deliver emails to their travellers:

8% of airlines sending IP addresses are blacklisted, meaning that email from these domains could be blocked from your email entirely. Good luck getting that flight update.
Only 40% of airline domains have adopted DMARC. Email delivery from the other 60% of airline domains is at high risk for fraud and phishing and may be more likely to end up in the Junk folder than the Inbox.
Only 14% of airlines are using Strict DMARC policies (7% Reject, 7% Quarantine). The remaining companies are at high risk of being used for fraud and phishing.
Only 1 Airline has deployed BIMI to display their logo in the recipients inbox. BIMI gives an extra level of assurance that the sender is legitimate and reinforces the corporate brand.

Protecting Your Brand with DMARC

To maintain the highest levels of email deliverability, businesses like yours (and these airlines) need a proven Email Delivery management system like MxToolbox Delivery Center. Delivery Center provides you with valuable insight into your email delivery posture and the on-going maintenance necessary to maintain peak performance:

Leverage our unique Adaptive Blacklist Monitoring to manage the email reputation of all your senders.
Manage SPF, DKIM and DMARC (and BIMI) to improve compliance and reduce the threat of fraud and phishing using your domain.
Review daily volume and SPF, DKIM and DMARC compliance rates to ensure the best email deliverability.
Implement Feedback Loops to gain unique information on how your recipients view your emails and when they mark you as spam.

The End of a Blacklist – BSB

On Friday the 17th of April, the blacklists BSB and BSB Domain shutdown. When a blacklist goes offline, it typically returns a positive blacklisting event for every IP address or Domain inquiry. This is standard but can be a bit alarming for users.

What that means for you?

All of our Monitoring and Delivery Center customers suddenly had a notification of blacklisting on BSB or BSB Domain. This is normal. MxToolbox has removed BSB and BSB Domain from the list of blacklists we check. All notifications that we previously sent of blacklisting by BSB and BSB Domain can be ignored safely. If BSB and BSB Domain return to action, then we will evaluate adding them back into the list of blacklists we search.

The Importance of Email Delivery Management

Blacklisting is not the only reason why your email may be denied or tossed into a Spam or Junk folder. Blacklist monitoring is the beginning of good email delivery management. In addition to monitoring your email for blacklisting, you need to:

Monitor your DMARC, SPF and DKIM configurations for compliance with industry standards
Regularly monitor the blacklist reputations of all your senders; not just your own IP addresses, but every CRM, Marketing Automation, Order Management, Support Ticketing and other sending system.
Actively monitor and manage the DMARC compliance rates for your legitimate senders, eliminating non-compliant senders if needed.
Monitor DMARC compliance rates for Fraud and Phishing attacks using your brands

MxToolbox Delivery Center provides you with the capability to manage your Email Deliverability, reducing the chance that your email will be dumped to spam or junk. Check out Delivery Centertoday, or Contact Sales for a Walkthrough of Delivery Center Managed Services.

A Little Blacklist History

History of Blacklists

Blacklist – in the context of technology, a list of items, such as usernames or IP addresses, that are denied access to a certain system protocol. When a blacklist is used for security purposes or access control, all entities are allowed access, minus those actually listed in the blacklist. Moreover, an email blacklist is a real-time database that utilizes criteria to determine if an IP is sending email it considers to be spam. There are many operable blacklists, and each has a unique way of accepting inbound mail and determining if messages are considered spam. Needless to say, blacklists directly impact the deliverability of your company’s emails.

Note: A Whitelist or whitelisting is NOT the opposite of a blacklist. A whitelist is a connection or group of IP addresses that will always be accepted, typically bypassing many other security controls. Do not ask for someone to whitelist you.

The first Domain Name System-based Blackhole List (DNSBL) was the Real-time Blackhole List (RBL) created in 1997 as a Border Gateway Protocol (BGP) list. Interestingly, the initial version of the RBL was not published using DNS, but rather a list of networks transmitted via BGP to routers owned by subscribers so that network operators could drop all TCP/IP traffic for machines used to send spam/host spam supporting services, such as a website. The term “blackhole list” is often interchanged with “blacklist” and “blocklist.”

Overview of Blacklists

Generally speaking, a DNSBL or RBL is an effort to stop email spamming. It is a blacklist of locations on the Internet believed to actively send email spam. The locations consist of IP addresses, which are typically linked to spamming. Most mail server software can be configured to reject or flag messages that have been sent from a site listed on one or more of these lists.

Furthermore, a DNSBL is a software mechanism, rather than a specific list or policy. There are many DNSBLs in existence, which use a wide array of criteria for listing and delisting addresses. For example:

The IP addresses of zombie computers or other machines being used to send spam (some RBLs specialize in spam in different languages)
Internet service providers (ISPs) who willingly host spammers, or those which have sent spam to a honeypot system.
List of the IP addresses of email systems that openly relay mail (which could be used by spammers)
List of dynamic IP addresses at ISPs
List of domain names typically used in spam emails.

In order to operate a DNSBL three things are needed: a domain to host it under, a nameserver for that domain, and a list of addresses to publish.

In addition, based on data received about your IP address, there are three places for your email to end up. If your company is on a blacklist, outbound messages could end up in spam or not delivered. If in good standing, your business emails will be then go through secondary processing by the inbox provider. Most will be delivered and show up in the inbox as intended. Most blacklist services set up their own specific methods, algorithms and honeypots and have websites that detail the reasons for listing along with delisting options. Delisting may be requested or may be automatic in some cases (keep reading). Note: Some less savory blacklists require a payment for delisting; Mxtoolbox does not approve of this type of business model.

What Is an IP or Domain Blacklist Problem?

Most businesses learn that their IP address is blacklisted when a customer reports missing an important email. After multiple reports, someone usually contacts IT who looks into the problem. Without proper monitoring of your blacklist status, your business could be at risk.

MxToolbox to the Rescue

An early innovator in addressing blacklist issues, MxToolbox built started with a free online Blacklist Check tool to help email admins, marketers, and business owners monitor their sending reputation. Since then, we have focused on email delivery solutions, introducing the most comprehensive Blacklist Monitoring service on the Internet and, now, providing DMARC-based email deliver solutions.

The Future of Blacklist Monitoring

MxToolbox believes in continually delivering innovative tools and services to help our customers who face an ever changing email world. Recently, we released Adaptive Blacklist Monitoring, expanding the frontier of blacklist monitoring beyond traditional blacklist monitoring for businesses to answer the following questions:

How do you maintain lists of all internal and external sender’s IP addresses?
How do you update IP addresses being monitored when they change?
How do you monitor cloud email services sending from large pools of IPs?

MxToolbox Adaptive Blacklist Monitoring leverages new technologies like SPF and DMARC to monitor your blacklist status and email deliverability across all of your senders: internal, external and cloud-based.

Automatic Monitoring

MxToolbox automatically detects all your Outbound IP addresses that you actively send email from and monitors them for blacklistings. Add a new 3rd party sender? MxToolbox automatically monitors those new IP addresses as well. With this solution you no longer need to maintain IP lists and update monitoring.

Sender/Cloud Email Reputation

Send email through Office 365 or GSuite, etc.? MxToolbox detects the IP addresses those services are actively using to send your messages and if they are blacklisted. You can even view your sender’s reputation via MxRep to gauge how well their services are functioning.