The DMARC Working Group has completed Last Call for the ARC specification. This means that when the final consensus changes are incorporated, the document will be submitted for approval and publication by the IETF. It is possible that the specification might be published before the next IETF meeting in November, though perhaps more likely between then […]
DMARC Deployments Quadruple In 2017
Using DNS query data supplied by Farsight Security, global deployment of DMARC appears to have grown by roughly 400% over the course of 2017. The portion of these domains publishing “quarantine” or “reject” policies – which generally prevent fraudulent messages using one of these domains from being delivered to the inbox – rose from 21% […]
Can I Use DMARC If I Have Only Deployed SPF?
A question people asked repeatedly in 2016 was whether or not their organization could deploy DMARC if they only used SPF at present. They knew the recommendation is to use both DKIM and SPF, and were concerned that their organizations couldn’t benefit from DMARC without DKIM. The short answer is that you can use DMARC […]
DMARC.org Presenting In Tokyo Nov 28th
DMARC.org Executive Director Steven Jones will be speaking about email authentication at TwoFive, Inc’s Cloud and Messaging Day event in Tokyo on Monday, November 28th. Also appearing will be Heikki Gruner of Cloudmark, and anti-spam campaigner Neil Schwartzman. A panel discussion later in the program will also feature noted email experts Shuji Sakuraba and Ayachika […]
United Kingdom Leading The Way In Email Security
The United Kingdom may have the most forward looking policies and deployment plans of any major government. Last week Chancellor of the Exchequer Philip Hammond announced a £1.9 billion national cyber security strategy that includes a broad series of measures, and will continue a series of improvements in email security that the UK government has […]
Zendesk moves to “p=reject”
Customer service and support platform provider Zendesk has employed DMARC to monitor email activity using their domains for several years. In September, Zendesk switched over 80,000 sub-domains that they use to support their customers to a “p=reject” DMARC policy. This prevents fraudulent email using these sub-domains from reaching consumers, and protects their customers’ and Zendesk’s […]
Australian Government Agency Recommends DMARC, DKIM, and SPF
In July the Australian Signals Directorate, part of the Department of Defence, and the Australian Cyber Security Centre issued a report for IT professionals titled, Malicious Email Mitigation Strategies. The report recommends the most effective methods of protecting organizations from email-borne attacks, and includes deploying DKIM, DMARC, and SPF. Furthermore it recommends using DMARC with […]
Common Problems With DMARC Records
It’s very common for any organization’s first attempt at a DMARC record to get the syntax or content wrong in some respect. This post will share some of the missteps and oddities seen while reviewing a dataset of captured Domain Name System (DNS) queries provided by Farsight Security. To be clear, all of the records […]
DMARC Required For UK Government Services By October 1st
Government Digital Service (GDS), part of the United Kingdom’s Cabinet Office, is requiring that other government departments adopt DMARC and HTTPS/HSTS to protect their online services by October 1st, 2016. This includes making the strongest DMARC policy (“p=reject”) the default for email services at that time. This will apply to all services operating under the service.gov.uk […]
Eleven Commercial Email Gateways Support DMARC
Businesses and other organizations can protect themselves from certain classes of phishing attacks on their employees by using DMARC to filter incoming email messages. But whether the company is large or small, they usually don’t have the expertise or resources to build their own filtering solution. That’s why commercial email gateways that support DMARC are […]