fbpx
Category: Security

SPF, DKIM, and DMARC: What They Are and Why You Need Them

The ease of sending and receiving email makes it an attractive way to run scams like phishing attacks. One telltale mark of a phishing attack is the sender’s address not matching their purported domain; attacks that appear to come from legitimate email addresses are much more likely to fool the victim.

You can protect your organization’s email accounts from being compromised and used in phishing attacks by training your users to identify forged emails and use password managers, which won’t autofill a password on a malicious site. But how do you prevent bad guys from forging email that looks like it comes from inside your organization? You can’t, but you can reduce the chances that other email servers will accept it. In the process, you’ll enhance the deliverability of legitimate email from your domain.

The rest of this article is aimed at two types of readers. The first is the IT professional who needs an overview of email authentication technologies and pointers to helpful tools. For other readers, this article will give you an idea of what’s involved so you can talk more knowledgeably with your IT staff or better appreciate what they manage for you.

Whether your email is hosted at Microsoft 365 or Google Workspace, or managed by your Internet service provider or IT department, if your organization has its own domain for email addresses—yourname@yourcompany.com—you need to know about and set up three authentication technologies: SPF, DKIM, and DMARC:

  • SPF, which stands for Sender Policy Framework, lets you specify which servers and domains are allowed to send email for your organization. It allows receiving mail servers to verify that incoming messages from your organization are actually from you.
  • DKIM, or DomainKeys Internet Mail, adds a digital signature to every message sent from your organization. Receiving mail servers can use your public key to verify that messages actually came from you and were not changed in transit.
  • DMARC, which expands to Domain-based Message Authentication, Reporting, and Conformance, leverages SPF and DKIM to publish policies that tell receiving mail servers what to do with messages that fail authentication: deliver, quarantine, or reject them. A message fails DMARC authentication only if it fails both SPF and DKIM—only one is necessary for the message to pass DMARC’s checks.

These three authentication technologies exist inside DNS (Domain Name System) records. The primary use of DNS is to link your human-usable domain name with the underlying IP addresses of the servers that manage your Internet presence; for example, matching www.yourcompany.com with an IP address like 192.168.1.23. However, DNS can also contain TXT records with additional information about your domain—you configure SPF, DKIM, and DMARC using TXT records.

These TXT records must be carefully constructed to work correctly—an incorrect configuration could cause email failures. You could build them manually, but it’s safer to use a tool that asks you questions and spits out a correctly formatted TXT record for you to add to your DNS configuration. If all that sounds intimidating, work with your ISP or email service provider, or ask us for help. But here are the basics.

Tools abound for creating SPF, DKIM, and DMARC records, but we recommend those from DMARCLY and EasyDMARC. We’ll use DMARCLY for the examples here, and it provides a comprehensive explanation that’s worth reading if you want more depth.

SPF

SPF is the oldest of these technologies. To get started, all you need to do in DMARCLY’s SPF Generator tool is specify the names or IP addresses of servers that are allowed to send email from your domain. The mx (mail exchanger) and a radio buttons automatically add the servers listed in your DNS records, and anything you put in the Includes field will allow email sent from anything allowed by a third party that sends email on your behalf. It’s common to put Google, Amazon SES, SendGrid, or other systems there. The IPv4, IPv6, and Hostnames fields let you specify other allowed servers, but aren’t necessary.

The Policy menu is important—you can choose from Fail, SoftFail, and Neutral. Start with Neutral, which should allow messages to be accepted (it prefixes all in the TXT record with a ?). Then bump up to SoftFail (a tilde ~ prefix) to have messages accepted but marked. When you’re confident everything is working correctly, move to Fail, which uses a - prefix.

DKIM

Because it relies on public key cryptography, DKIM is significantly more complicated. Although DMARCLY’s DKIM Generator tool will generate the necessary public and private keys, that’s not helpful unless you have full control over your email server and know how to install the private key to sign all your outgoing email. It’s much more likely that you’ll use a tool managed by the company that hosts your email to create your keys. That tool will automatically install the private key and give you the necessary details to add to a TXT record in your DNS settings.

DMARC

Where SPF and DKIM are all about authenticating email messages, DMARC lets you say what happens when authentication fails. DMARCLY’s DMARC Generator tool makes it easy to generate your DMARC record. For Policy and Subdomain Policy, you can choose None, Quarantine, or Reject—those specify what will happen to messages that fail both SPF and DKIM authentication. Start with None to see what happens in your reporting, move to Quarantine, and if everything seems OK, end up at Reject.

To set up reporting, enter an email address in the Aggregate Email field, but don’t put a personal address there. DMARC reports are daily XML digests that aren’t human-readable, so they should be sent to a service that will parse them and provide you with a dashboard for exploring the problems. DMARCLY and EasyDMARC both offer dashboards, as does the Cloudflare service if you use it for DNS or other tasks. To start, you can leave DMARC’s Strict Alignment and Forensic Options blank.

Configuring DNS

Once you’ve generated your SPF, DKIM, and DMARC records, you have to configure them in your DNS settings. How you do that depends on your DNS host; we’ll show what it looks like Cloudflare. Other DNS hosts should be similar.

For each case, you’re creating a TXT record, but what goes in the Name and Content fields varies:

  • SPF: The name for an SPF record should be the @ character, signifying the root level of your domain. Paste the text that the SPF Generator tool created in the Content field. You can have only one SPF record for each domain, although you can set up separate SPF records for subdomains.
  • DKIM: You can have as many DKIM records as services that send email on your behalf, so the first part of the name can vary—we show example below. However, the ._domainkey part is required for each DKIM record. For the content, paste the text given to you by the email-sending service. Note that some email services may require you to create one or more CNAME records instead of a TXT record—just follow their instructions.
  • DMARC: For DMARC, the name must be _dmarc. Once again, you’ll paste the text given to you by the DMARC Generator tool in the Content field.

Reporting and Evaluation

After you set up SPF, DKIM, and DMARC, it’s essential to keep an eye on your email. If you’ve started with SPF in Neutral mode and DMARC in None, nothing should go wrong. You can look through the headers of test messages you send to verify. This DMARCLY article explains what to look for. If you’ve signed up for an aggregate reporting service, you’ll be able to see reports like this one from Cloudflare that show the percentage of email that passes each of the authentication technologies.

If everything looks good and most email passes, change SPF to SoftFail and DMARC to Quarantine. Make sure you can send email to some known personal addresses on Gmail, Yahoo, or iCloud. Also, tell people who send email from your domain to be on the alert if they don’t hear back from someone who typically replies quickly—if a misconfiguration is causing your email to be marked as spam, you want to know about that quickly. If you’re using a DMARC reporting service, look at those reports to see if any email services are sending a lot of messages that fail DMARC.

After you’ve run with those settings for a month or two, bump SPF up to Fail and DMARC to Reject. Continue to monitor your DMARC reporting and pay attention to any complaints from users about the messages they send not arriving.

That’s a lot, we know. Feel free to contact us if you need help with any step of the process.

(Featured image based on an original by iStock.com/Ole_CNX)


Social Media: To ensure phishers don’t forge email from your domain to use in their attacks on your organization and others, you must implement SPF, DKIM, and DMARC. We explain the basics, and we’re happy to help with the setup.


Use 1Password to Enter Your Mac Login Password

We think of 1Password as being helpful for entering passwords on websites and in iPhone and iPad apps. But its Universal Autofill feature has a hidden capability that lets 1Password enter your Mac login password when you have to provide it to change certain system settings, install apps, format drives in Disk Utility, and more. (But it won’t work to log in at startup before 1Password is running.) To turn this feature on, click the New Item button in 1Password, search for and select “Mac login” , give it a name that will sort alphabetically to the top, like “2020 27-inch iMac” , enter your password, and click Save . From then on, whenever you’re prompted for your Mac login password , press Command-\ (Backslash, located above the Return key), and then click the desired login or press Return to select the topmost item .

(Featured image based on an original by iStock.com/ipuwadol)


Social Media: 1Password is tremendously helpful for entering website passwords, but a little-known feature also enables it to enter your Mac login password for changing system settings, installing apps, and more.


Six Reasons Why You Should Restart Your Mac Periodically

Long ago, before macOS was as stable as it is today, Mac users restarted their Macs regularly. Back then, Macs couldn’t sleep, either, so it was common for users to shut down at the end of the day and start up the next morning, effectively restarting daily.

With modern Macs using the barest trickle of power in sleep and both apps and macOS almost never crashing, many Mac users have gone to the opposite extreme, letting their Macs run for months between restarts. However, such an approach brings with it new problems, and as with so many things, there’s a happy medium.

Why are we banging this particular drum? As an off-the-cuff estimate, about a quarter of the problems reported to us can be solved by a restart. Really! Just click the Apple menu and choose Restart. As long as you save your work first or when prompted, nothing bad will happen.

Here are our top six reasons you should restart periodically:

  • Improved security: Restarting itself doesn’t generally improve security (although it could theoretically clear malicious code running in memory). However, installing macOS updates requires a restart, and we strongly recommend installing security-focused updates shortly after they’re released. If you resist installing updates because of the need to restart, you’re increasing your risk significantly.
  • Resolve problems: Modern Macs may be more stable than ever, but things can still get funky. If apps are crashing, peripherals aren’t connecting, you’re seeing visual glitches, or anything else seems wrong, the first troubleshooting step is a restart.
  • Better performance: We all have a feel for how long different tasks on our Macs take. If icons for launching apps bounce longer than usual, windows draw slowly, or you see the spinning pinwheel repeatedly, restart. Performance problems are often caused by a poorly coded app or out-of-control process causing your Mac to run out of physical memory and switch to slower virtual memory. Restarting clears such issues.
  • Recover drive space: Another memory-related bonus of restarting is that it can free up drive space. When macOS starts to rely on virtual memory, it creates swap files that can consume gigabytes of space. Restart, and all that space is returned, at least until your app usage requires it again.
  • Get updates: Most apps notify you of updates at launch, and some automatically download their updates but install them only when you quit. Either way, a restart results in all your apps quitting and relaunching, which ensures they either install or at least notify you of important updates.
  • Start fresh: Even if having 20 or more apps open isn’t affecting your Mac’s performance, a clean slate can help you focus on your work better. A simple restart quits everything and lets you start over with just those apps set to launch at login. For a completely fresh start, make sure to deselect “Reopen windows when logging back in” in the restart dialog. Of course, if you have a lot of documents open and need to return to them, leave that checkbox selected to pick up exactly where you left off.

There’s no set schedule on which you should restart, but if you use a Mac at work and like routines, it wouldn’t be problematic to restart on Friday evening as you wind down to leave for the weekend. That way, you’d return to a clean slate on Monday morning. It’s also totally fine to restart whenever it might be helpful.

Just don’t fear the restart—modern Macs, especially those with Apple silicon, restart quickly, and the benefits far outweigh the few minutes of downtime.

(Featured image based on an original by iStock.com/Armastas)


Social Media: You can go for weeks or months without restarting your Mac, but it’s a good idea to restart more frequently to increase security, avoid or resolve problems, get updates, and generally clear your Mac’s decks.


Use Face ID While Wearing a Mask in iOS 15.4

Shortly after the start of the COVID-19 pandemic, Apple made it so your Apple Watch could unlock your Face ID-enabled iPhone when you were wearing a mask. Starting in iOS 15.4, the company has taken the next step and enabled Face ID on the iPhone 12 and later to work even when you’re wearing a mask. If you didn’t already set up Face ID with a mask after updating to iOS 15.4, go to Settings > Face ID & Passcode and enable Face ID with a Mask. You’ll have to run through the Face ID training sequence again, and more than once if you sometimes wear glasses, but it’s quick and easy. Face ID may not work quite as well when you’re wearing a mask, and it doesn’t support sunglasses, but it’s way better than having to enter your passcode whenever you’re masked.

(Featured image by iStock.com/Prostock-Studio)


Upgrade to iOS 14.5 and watchOS 7.4 to Unlock Face ID iPhones with Your Watch

You have to feel for Apple sometimes. The company’s engineers put an astonishing amount of work into the hardware and software necessary for Face ID to recognize your face nearly instantly and unlock your iPhone or iPad. Regardless of whether you’re wearing a hat and glasses. Even in the dark. It’s one of those pieces of technology that’s so advanced that it’s indistinguishable from magic.

But the one thing that stymies Face ID every time is also the most important factor in curbing the spread of the coronavirus: the humble face mask. We’ve all been wearing masks for the past year, so if you have an iPhone X or later with Face ID, you’ve undoubtedly been annoyed by having to tap in your passcode repeatedly while masked. Early in the pandemic, Apple tweaked iOS 13 so you could enter a passcode without waiting for Face ID to fail. That was a help, but with the just-released iOS 14.5, Apple has now made the problem go away entirely, at least if you have an Apple Watch.

Here’s how it works. Once you’ve updated your Face ID–enabled iPhone to iOS 14.5 and your Apple Watch Series 3 or later to watchOS 7.4, you can enable the Unlock with Apple Watch setting. From then on, if your mask prevents Face ID from unlocking your iPhone, iOS will check to see if your watch is nearby, on your wrist, protected by a passcode, and unlocked. If so, your iPhone unlocks immediately, just as though it had scanned your face successfully. Your Apple Watch also taps your wrist to alert you and give you the option of locking the iPhone again, just in case someone has surreptitiously snagged your iPhone and is using the feature to unlock it in your presence.

To enable this feature, go to Settings > Face ID & Passcode on your iPhone, scroll down to Unlock with Apple Watch, and turn on the switch next to your Apple Watch. If you don’t have a passcode enabled for your Apple Watch, turn that on in the Watch app, in My Watch > Passcode. (While you’re on that screen, be sure to enable Unlock with iPhone too, since that prevents you from having to type the Apple Watch passcode in nearly all situations.)

That’s all there is to it—it’s brilliant! Apple undoubtedly put a great deal of thought into architecting this feature so it’s easy to use without compromising the iPhone’s security. If you haven’t yet updated to iOS 14.5 and watchOS 7.4, we encourage you to do so right away to take advantage of this feature. And if you don’t yet have an Apple Watch, this might be reason enough to get one.

(Featured image by Uriel Mont from Pexels)


To Prevent Spearfishing, Set a PIN or Passcode on Your Cell Phone Account

Spearfishing. It’s no longer just a tropical ocean sport that could provide seafood for dinner. In today’s tech world, spearfishing is when someone targets you specifically, usually with the goal of taking over your online accounts. Once that’s done, the attacker will try to siphon money from your bank account, impersonate you in an attempt to deceive family or colleagues into sending money, or attempt to ruin your reputation.Read More


Privacy Settings
We use cookies to enhance your experience while using our website. If you are using our Services via a browser you can restrict, block or remove cookies through your web browser settings. We also use content and scripts from third parties that may use tracking technologies. You can selectively provide your consent below to allow such third party embeds. For complete information about the cookies we use, data we collect and how we process them, please check our Privacy Policy
Youtube
Consent to display content from - Youtube
Vimeo
Consent to display content from - Vimeo
Google Maps
Consent to display content from - Google