A brief and Simple introduction to Email Sending Security solutions
Email security consists of complex multi-layer areas of protection.
The most obvious to the layman is to check for viral loads, block phishing attempts and maximise user awareness all to minimise damage from received emails. But… What about the reverse, your outbound emails need to be protected too, your receivers need to have trust that the email from your domain is genuine and trustworthy. Many companies these days will reject emails that do not pass what has become the industry standard test for proof of origin. Nefarious people can and do impersonate emails in attempts to gain access or information to unwary companies, this is called “Spoofing”.
Here I will break down and explain in easy terms the methods you need to employ to digitally sign your outbound emails.
1: – The basic, this is your SPF record (Sender Policy Framework) This is bit of text added to your DNS record. This is the first thing you need to do; it is the quickest and easiest and without this most receivers will bounce your email.
2: – Step two, DKIM (DomainKeys Identified Mail). Again, this is a small text record added to your DNS record you also have it configured in your email security policy so that it adds a digital signature to all your outbound email, receivers’ emails systems compare the two to confirm validity.
3: -The combo, DMARC (Domain-based Message Authentication, Reporting and Conformance). Once more a text record is added to your DNS, this tells the receiver that your email is protected by both SPF and DKIM and they can then check your email has both, if it fails either or both tests, they can decide to block it, let it through or quarantine it for further analysis.
Utilising the above three methodologies is the best way to help prevent your emails being spoofed, but the story doesn’t end there. This takes care of validity of your email actually coming from your email service, but what about while it’s on the wire as it flies to your recipient’s email service, there is a potential here for hackers to gain access to the information and even modify it, so now we look at the transport security.
MTA-STS (Mail Transport Agent Strict Transport Security), Without this entry in your DNS record your mail is simply sent and expected to arrive, using MTA-STS allows the recipient to query your DNS records (yes, you guessed it another text entry) to see if you are configured to use a more secure encrypted version of sending the email, if it finds you are then both sides shake hands and work secretly to get the message through.
The last thing I want to cover is BIMI (Brand Indicator for Message Identification). This is a neat way to brand your emails and gives them yet another layer of authenticity, Once configured your emails will have that little bit of branding attached to them, so your recipients know that this email is safe and secure. Marketing loves this one, its great advertising, below is how emails from LinkedIn show
Here at Netmanage It Solutions we offer all of this protection in our WarpDMARC solution, our easy to implement and manage package We will of course be on hand to help you every step of the way in configuring your Email security. NB. There is an added bonus to our solution, with the SPF record there is a 10-record limit, every organisation that you permit to send on your behalf such as Salesforce, NetSuite etc. all get a separate entry in your SPF record, go over 10 items and people will start to reject your email as it fails the SPF check. We have the perfect solution for this in our WarpDMARC, dynamically handling as many entries as you like and will have only one Text record in your DNS Feel free to reach out to us if you want any more information Mail@netmanageit.co.uk