A new presentation explaining the basics of how email authentication works is available from DMARC.org. The concepts and common usage of SPF, DKIM, and DMARC are all covered in this introductory slide deck, which is made available under the Creative Commons Attribution-ShareAlike 4.0 International License (CC BY-SA). You can download the 1.9MB PDF file clicking […]
eco, the largest Internet industry association in Europe, released a paper in late March addressing DMARC and the data privacy laws of the EU. The short answer is that mailbox providers should feel free to implement DMARC filtering and send aggregate reports to domain owners, even under the very stringent data privacy laws of Germany. […]
An initiative organized by the Dutch government, industry organizations, and the Internet Society is offering a website where users can see if their email provider is using a range of modern Internet standards: IPv6, DNSSEC, TLS, DKIM, DMARC, and SPF. Use this link in English or this link in Dutch to access the site, which […]
On April 15-16th multiple sources reported seeing an increase in the number of DMARC reports generated or received. Between two and three and a half times as many reports per day were observed, depending on the source. There was some hope there would be a public announcement during the RSA Conference in San Francisco last […]
Effective email authentication requires an organization to have clear control of its messaging operations, and it can take a lot of work to get there if you don’t already have it. But many don’t realize that deploying DMARC – before or while you’re deploying DKIM and SPF – can offer a valuable external view of […]
The more popular a website is, the more likely the average consumer is to trust a fraudulent message that impersonates that website’s Internet domain. One might expect that the websites at the top of the list employ email authentication to protect against that possibility, but what about sites further down the list? This piece will […]
Dateline: April 1, 2015; Berkeley, California – Today major mailbox providers and email senders expressed their frustration that nobody is phishing their customers and domains. The universal adoption of email authentication technologies such as SPF, DKIM, and DMARC, and the sudden elimination of spam, has caused criminals to abandon this once-popular activity. “I guess I […]
A recent Trend Micro blog post suggests that the bad actors behind a current ransomware campaign are using email authentication and DMARC to make their messages more effective. One online article citing the post even includes a headline that incorrectly suggests that DMARC somehow enables the malware to bypass filters – which it assuredly does […]
On February 12th Kaspersky Labs published a report titled “Financial cyberthreats in 2014.” This report takes a broad view of malware and email-based attacks on financial institutions and/or their customers. It notes some broad trends, like an almost 6% decrease in phishing attacks against banks, and that the number of malware attacks involving Bitcoin mining […]
You might expect that the IT department or security team knows who’s sending email using your company’s domains. But for a variety of reasons these groups are often unaware of many legitimate senders — not to mention all the bad actors. Fortunately you can get a more complete view by using DMARC‘s reporting features.