DMARC-Whitepaper

whitepaper
dyn.com
@dyninc
The Importance of DMARC
Intro to DMARC
With over 144 billion emails sent every day, spammers and phishers have a
rapidly growing playground for their attacks. In order for your Internet Service
Provider (ISP) to determine that the emails your company sends are indeed
from a verified sender and not spammers, you must authenticate your sends.
Domain-based Message Authentication, Reporting & Conformance (DMARC)
has been created as a standard to help properly authenticate your sends and
monitor and report phishers that are trying to send from your name.
How DMARC Works
In order to get the most out of DMARC,
Sender Policy Framework (SPF) and
DomainKeys Identified Email (DKIM)
must first be set up. DMARC uses both
SPF and DKIM to verify the validity of
messages being sent. In some cases,
depending on how strict or lenient the
sender needs to be, both can be mandatory
or only one could be required.
Assuming you already have working
DKIM and SPF, DMARC is essentially a
public statement informing ISPs that
you would like them to authenticate
your mail with DKIM, SPF, or both. After
you send a message, the receiver will
check your SPF and DKIM, making sure
they align with your DMARC identifier. It
does this by querying the DNS records
for the domain where the message
claims to come from and checks for a
DMARC record.
the email delivery process with dmarc
If the message passes the stated authentication methods (making it aligned
mail), it will then continue onto standard processing (e.g. anti-spam filters) and
then eventually make it to its end destination.
If a message is deemed unaligned, multiple different actions can happen. It
should be noted that not all unaligned mail should be considered spam as an
authorized message can end up passing as unaligned for different factors like
an upgrade in infrastructure or an authorized 3rd party sender that doesn’t
have your DKIM and SPF authentication set up.

whitepaper
dyn.com
@dyninc
p2: The Importance of DMARC
In your DMARC setup, you will have told the receiver what to do with unaligned
messages: do nothing and continue as normal, quarantine the message and
move it along with suspicion, or completely reject it. Right now, these are the
only three options set up in DMARC, but these allow for a low risk implementation
time where you can monitor mail from your organization and slowly
tighten your DMARC controls.
Why is DMARC Important?
Reputation is crucial in business. If your brand experiences phishing attacks,
customers are 42 percent less likely to do business with you.
DMARC can help in making sure that your brand and your customers are safe
from imposters, giving you, and more importantly them, peace of mind. With
DMARC, you are able to keep an eye on sending by rejecting messages before
phishers are able to make a full-fledged attack.
However, if you are rejecting every unaligned message, you may be keeping
authorized mail from sending. Sometimes, if you do not preemptively set it up,
authorized 3rd party senders, mail sent after infrastructure changes, mail sent
from new products/subdomains, or even from mergers and acquisitions could
be marked as a false positive in a DMARC report. DMARC offers summaries and
detailed reports that help you better understand how your emails are being
received. With this info, you can successfully adjust the breadth of your email
sends to assure receivers that you’re sending email from a highly reliable mail
infrastructure.
Keeping on top of monitoring and the reports that you receive can allow you
to make sure that you have caught these edge cases and can make adjustments
to ensure they are marked as verified senders with a reputable infrastructure.
If you find that you do have a phishing problem, you can take action to get that
mail blocked and protect your customers.
The Next Steps
If you are currently using an Email Service Provider (ESP) to send your
messages, you can work closely with them to make sure that you are set up
for DMARC. Either check if you have already set up SPF and DKIM or ask your
account representative to help you with the steps to roll out DMARC.
If you are sending out your email internally (or even if you just want to learn
more about DMARC), DMARC.org is a great resource for ensuring that you are
properly following DMARC specifications.
Start authenticating your mail with DMARC today.
Contact us to get started: sales@dyn.com +1.888.840.3258
© 2013 Dyn. All rights reserved. DynECT is a trademark or registered trademark of Dyn and such marks are protected by law.