Tag: dkim

  • DKIM? DMARC? How to stop scammers from using your company’s domain for nefarious purposes

    DKIM? DMARC? How to stop scammers from using your company’s domain for nefarious purposes

    You have probably heard the terms SPF, DKIM, and DMARC thrown around during conversations about email security. They sound technical, and it can be tempting to assume they are only relevant to large companies or IT departments.

    In reality, these protections matter to every business that uses email. Without them, scammers may be able to send fraudulent messages that appear to come from your company’s domain. They can impersonate executives, request payments, distribute malware, or trick customers into revealing sensitive information.

    Even if fraudulent email never touches your actual email system, your company’s name and reputation can still take the hit. Starting with DMARC, which stands for Domain-based Message Authentication, Reporting, and Conformance.

    DMARC works alongside two other email authentication technologies:

    • SPF, or Sender Policy Framework, identifies which servers are authorized to send email for your domain.
    • DKIM, or DomainKeys Identified Mail, adds a digital signature that helps prove an email was authorized and was not altered in transit.

    Together, these technologies give receiving email systems a way to determine whether a message claiming to be from your domain is legitimate.

    So how does domain spoofing work?Email was not originally designed with strong identity verification. In many cases, a scammer can place your company’s domain in the visible “From” field of an email without gaining access to your Microsoft 365, Google Workspace, or other email account.

    To the recipient, the message may appear to come from:

    The scammer might then request a wire transfer, send a fake invoice, ask an employee to purchase gift cards, or direct a customer to a fraudulent login page. This is known as domain spoofing. It is different from an attacker breaking into an actual mailbox, but it can still be extremely damaging.

    Next, SPF is a DNS record that lists the email services allowed to send messages on behalf of your domain.

    For example, if your company uses Microsoft 365, your SPF record should authorize Microsoft’s mail servers. If you also use a marketing platform, ticketing system, or invoicing application, those systems may need to be included as well. When a receiving mail server gets a message claiming to come from your domain, it can compare the sending server against your SPF record.

    A properly configured SPF record helps identify unauthorized senders. However, SPF alone is not enough. It can fail when messages are forwarded, and it does not always protect the address users see in the From field.

    Lastly, DKIM adds a cryptographic signature to outgoing email.

    The sending platform uses a private key to sign the message. The matching public key is published in your domain’s DNS records. Receiving systems can use that public key to verify that the message was authorized by your domain and that important parts of the email were not modified after it was sent.

    DKIM is especially important for cloud email platforms and third-party services that send email on your behalf.

    If your company uses services such as email marketing tools, billing platforms, customer relationship management systems, or help desk software, each service may require its own DKIM configuration. DMARC brings SPF and DKIM together and tells receiving email systems what to do when authentication fails.

    A DMARC policy can instruct the receiving system to:

    • Deliver suspicious messages to spam or quarantine
    • Reject unauthorized messages completely

    DMARC also provides reporting. These reports can show which systems are sending email using your domain and whether those messages are passing authentication. This visibility is extremely valuable. It can help uncover forgotten applications, configuration problems, and unauthorized attempts to impersonate your business.

    Many companies publish a DMARC record with a monitoring-only policy and never move beyond it. A monitoring policy is a good starting point, but it does not instruct receiving mail systems to block spoofed messages. It mainly collects information. Businesses are often hesitant to enforce DMARC because they are concerned about accidentally blocking legitimate email. That concern is valid.

    A company may have several systems sending email, including:

    • Microsoft 365 or Google Workspace
    • Marketing, accounting, support, scheduling, and website platforms

    If those systems are not identified and configured correctly, moving directly to a strict DMARC policy can cause legitimate messages to fail. The right approach is to monitor first, fix authentication issues, and then gradually increase enforcement. A proper implementation usually happens in stages.

    First, your IT provider should inventory every platform that sends email using your domain. SPF and DKIM should then be configured for each legitimate service.

    Next, DMARC reporting should be enabled so your team can review authentication results and identify unknown senders.

    Once legitimate traffic is consistently passing authentication, the DMARC policy can be moved from monitoring to quarantine. After additional review, it can be changed to reject. This staged approach reduces risk while steadily improving protection.

    There are common pitfalls to implementing these protections in your business. One of the most common mistakes is having multiple SPF records. A domain should generally have only one SPF record, with all authorized senders included in that record. Another common problem is exceeding SPF lookup limits. Adding too many services can cause SPF validation to fail, even when the record appears correct. Other issues include expired DKIM keys, marketing systems that were never authenticated, and DMARC records that remain in monitoring mode for years.

    Email authentication is not a one-time project. It should be reviewed whenever your company adds or removes a system that sends email. Does DMARC stop every scam email ? No, no single technology stops every threat.

    DMARC is highly effective at reducing direct domain spoofing, but attackers may still register lookalike domains. For example, they could replace a letter in your company name or add a word such as “billing” or “support.” Attackers can also compromise real employee mailboxes through phishing, stolen passwords, or weak multifactor authentication.

    That is why DMARC should be part of a broader email security strategy that includes:

    • Multifactor authentication and strong account security
    • Employee training, email filtering, and ongoing monitoring

    DMARC protects your domain’s identity. It does not replace the need to secure the accounts and people using it. When scammers impersonate your domain, the damage can extend beyond a single fraudulent email. Customers may lose confidence in your company. Employees may become hesitant to trust legitimate messages. Vendors may question payment requests, and your domain’s reputation may suffer with major email providers.

    SPF, DKIM, and DMARC help prove that legitimate email is really coming from your business. They also make it much harder for attackers to use your domain as a disguise.

    Valley Techlogic can review your current email authentication setup, identify unauthorized sending sources, configure SPF and DKIM correctly, and help move your DMARC policy toward full enforcement without disrupting legitimate email. Do not wait until a customer receives a fake invoice or an employee responds to a fraudulent executive request. Protect your domain before a scammer decides to use it, reach out for a consultation today to get started.

    This article was powered by Valley Techlogic, leading provider of trouble free IT services for businesses in California including Merced, Fresno, Stockton & More. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on X at https://x.com/valleytechlogic

  • Are your emails not getting through? Changes to Google and Yahoo DMARC Policy might be to blame

    Are your emails not getting through? Changes to Google and Yahoo DMARC Policy might be to blame

    Email deliverability can be tricky to guarantee, and now with recent changes to Google and Yahoo’s DMARC policies getting your emails delivered to your customers and prospects may be even more difficult.

    First, we should start out by explaining what DMARC is, DMARC or Domain Based Message Authentication is the process that checks to make sure the email that’s being sent is being sent from the domain it’s proclaiming to be. Its main purpose is to protect against email spoofing, which is when you have an email that says it’s from @yourdomain.com but is really from @notyourdomain.com.

    Why is that important? Ideally you do not want potentially bad actors being able to masquerade as you on the web and contact your customers or potential customers. The hiccup is that setting up DMARC and the provisions that go into it (SPF or Sender Policy Framework and DKIM or DomainKeys Identified Mail) are not for the faint of heart.

    SPF and DKIM are the groundwork that is then checked by DMARC, and we apologize for throwing all of these acronyms at you, but we promise they’re important if you are a business who relies on email (and who in the current day and age doesn’t?). Especially if most of your customers have Gmail or Yahoo emails.

    Gmail and Yahoo have both updated their policies to take a tougher stance on emails being sent without these policies set in place. To put it simply, if you don’t have these setup your emails are going to be sent to the spam box or not reach your target at all.

    So how do you begin setting up, SPF, DKIM, and DMARC for your business?

    SPF (Sender Policy Framework):

    1. Access your DNS records: Log in to your domain registrar or DNS hosting provider where your domain’s DNS records are managed.
    2. Create or edit your SPF record: Locate your domain’s DNS settings and add a TXT record. If you already have an SPF record, you’ll need to edit it. If not, create a new one.
    3. Define your SPF policy: In the TXT record, specify which servers are authorized to send emails on behalf of your domain. This is done by listing the IP addresses or domain names of your authorized email servers. For example, if you use Google Workspace for your email, your SPF record might include something like: “v=spf1 include:_spf.google.com ~all”. This indicates that Google’s servers are allowed to send emails for your domain.
    4. Test your SPF record and Publish your SPF Record: Use SPF testing tools to verify that your SPF record is correctly configured. There are various online tools available for this purpose. Once you’re confident that your SPF record is set up correctly, save the changes in your DNS settings. It may take some time for the changes to propagate across the internet.
    5. Monitor and maintain: Periodically review your SPF record to ensure it remains accurate. If you change your email infrastructure, update your SPF record accordingly.

    DKIM (DomainKeys Identified Mail)

    1. Generate DKIM keys: You’ll need to generate a pair of DKIM keys – a private key and a public key. The private key will be used to sign outgoing emails, and the public key will be published in your domain’s DNS records for email receivers to verify the authenticity of your emails. This tool can be used to generate DKIM keys for you.
    2. Add DKIM DNS record: Log in to your domain registrar or DNS hosting provider where your domain’s DNS records are managed. Add a new TXT record to your DNS settings. This record should contain your DKIM public key along with some DKIM-related tags that specify the version, the domain, and the selector for your DKIM keys.
    3. Configure your email server: Set up your email server to sign outgoing emails using the private key you generated earlier. Most email servers have built-in support for DKIM signing, and you’ll usually need to specify the location of the private key and the DKIM selector.
    4. Test DKIM: Send a test email from your domain and verify that it’s properly DKIM-signed. You can use various online DKIM validation tools to check if your DKIM setup is correct.
    5. Monitor and maintain: Regularly monitor your DKIM setup to ensure that it’s functioning correctly. If you change your email infrastructure or rotate your DKIM keys, remember to update your DKIM DNS record accordingly.

    DMARC (Domain-based Message Authentication)

    1. Create a DMARC policy: Determine what action you want email receivers to take when they receive emails that fail DMARC authentication. Options include monitoring (no action), quarantining (sending suspicious emails to spam folders), or rejecting (blocking suspicious emails).
    2. Publish your DMARC record: Log in to your domain registrar or DNS hosting provider and add a TXT record to your domain’s DNS settings. This record contains your DMARC policy along with additional information such as the email address where DMARC reports should be sent.
    3. Monitor and maintain based on DMARC reports: Configure your email system to generate DMARC reports and send them to the specified email address. These reports provide valuable information about how your domain is being used for email, including details about SPF and DKIM alignment.

    We hope the breakdown of how to setup these policies was helpful, but if you’re looking at this list and thinking there’s no way I can implement this on my own then that is where Valley Techlogic can help.

    We have helped our clients navigate domain challenges and answer technical questions such as how to improve email deliverability on top of providing IT solutions that help navigate other day to day technological challenges. Get started with us today.

    Looking for more to read? We suggest these other articles from our site.

    This article was powered by Valley Techlogic, an IT service provider in Atwater, CA. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on Twitter at https://x.com/valleytechlogic.