Imagine receiving an email that appears to come from your administrator's address, asking the business office to change a vendor's bank details. The message was never sent by your administrator. Someone forged the sender address. Without protective settings, this kind of spoofing can be surprisingly easy.
Three email standards, SPF, DKIM and DMARC, help prevent it. They also affect whether your own legitimate messages reach inboxes, since major email providers increasingly expect senders to use them. You do not need to be technical to understand them, only to ask the right questions of whoever manages your domain and email.
Every email says who it is from, but that claim is not verified by default. SPF, DKIM and DMARC are ways for a domain owner to publish rules and proofs, in public records called DNS, so receiving servers can check whether a message is legitimate.
Sender Policy Framework is a published list of the servers and services allowed to send email for your domain. When a message arrives claiming to be from your organization, the receiving server checks whether it came from an authorized source.
Think of it as a guest list at the door. Common mistakes include forgetting to list a service that legitimately sends on your behalf, such as a newsletter platform, billing system or eFax service, or listing too many sources over time.
DomainKeys Identified Mail adds a digital signature to outgoing messages. The signature is created with a private key held by the sending system and checked with a public key published in DNS. If the message is altered in transit, or was not signed by an authorized system, the check fails.
Think of it as a wax seal. Each email service that sends on your behalf should be set up to sign messages.
Domain-based Message Authentication, Reporting and Conformance ties SPF and DKIM together and tells receiving servers what to do when a message fails. It also sends you reports about who is sending mail using your domain.
DMARC offers three policy levels:
None: monitor only, take no action. Useful for learning.
Quarantine: suspicious messages go to spam.
Reject: failing messages are refused.
The goal for most organizations is to eventually reach quarantine or reject, which blocks spoofing of your domain.
Fraud prevention: Criminals impersonate leaders, vendors and payers to redirect payments or steal credentials.
Protecting families and referral partners: Fake messages in your name can reach people who trust you.
Deliverability: Messages from properly authenticated domains are more likely to reach recipients' inboxes. Large mailbox providers have announced stricter requirements for bulk senders beginning in 2024.
Security posture: Insurers and auditors may ask whether DMARC is in place, and email security is part of protecting electronic protected health information in transit.
List every system that sends email using your domain: your main email platform, marketing tools, website forms, scanners and copiers, billing and EHR notifications, and eFax. Missing one can cause its messages to be blocked later.
Work with your email and DNS administrators to publish an SPF record and enable DKIM signing for each sending service.
Publish a DMARC record with a none policy and a reporting address. Collect reports for a few weeks. Reports are technical, so a reporting service or your IT provider can help summarize them.
Use the reports to find legitimate sources that fail checks, and correct their settings.
Shift to quarantine, then reject, watching for problems. A staged approach prevents accidental blocking of real mail.
Whenever you add a new service that sends email on your behalf, update your records.
Do we have SPF, DKIM and DMARC records on all of our domains?
What is our current DMARC policy?
Who reviews the reports?
What about domains we own but do not use for email? These should be set to reject, since attackers love unused domains.
These standards stop forged messages from your exact domain. They do not stop lookalike domains or phishing from compromised accounts, so combine them with filtering, multi-factor authentication and staff training.
UnityCare IT can check your current email authentication settings and guide a safe rollout. Contact us if you would like a quick review of your domains.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172