Bytes Cyber Journal: Entry 11 - Dealing with DMARC

Friday 18th October 2024

Courtney Williams

Cyber Security Solutions Specialist

Author

Georgia Moore

Marketing Executive

Editor

Dealing with DMARC

Brand Protection end Email Deliverability

No matter how far we have come with technology, email remains a primary communication tool for businesses. As convenient as this is it also presents a significant security risk, with phishing and email spoofing attacks becoming increasingly sophisticated due to the rise of such tools as generative AI. To combat these threats, organizations need robust email authentication protocols. One such protocol is DMARC (Domain-based Message Authentication, Reporting & Conformance). With an increase in mandates and Google and Yahoo implementing stringent policies around email authentication now is the time to make a start on your DMARC journey.

The Challenge

DMARC is seen as a complex task to implement, and a lot of people don’t know where to start. Having an understanding on who can send emails on your organisation’s behalf is crucial for maintaining security standards and for protecting your brand, so why do companies still not have DMARC in place?

A few reasons could be down to:

Perceived complexity – Implementing DMARC involves an understanding of SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) which can be complex and may deter organisations from adopting DMARC.
Resource Constraints - Implementing DMARC requires time, expertise, and financial resources. Many organizations, especially smaller ones, may lack the necessary resources to manage the implementation and ongoing maintenance.
Fear of disrupting email delivery - One of the primary concerns is that DMARC might block legitimate emails. If not configured correctly, DMARC policies can lead to important emails being rejected or quarantined, disrupting business operations.

Some Key considerations around DMARC:

If you are sending 5000 or more emails to Google or Yahoo mailboxes then you need to have a DMARC policy in place. The messages must pass DMARC alignment otherwise the messages will go undelivered.
PCI DSS v4 guidance states that it is recommended (but not required) that anti-phishing controls are applied across an entity’s entire organisation. Implementing a DMARC project is something all companies should be doing. Having a DMARC status of p=reject will help prevent your email from being spoofed and protect your customers and suppliers.

The Benefits of implementing DMARC:

Enhanced security by preventing spoofing and phishing attacks and ensuring only legitimate mail is being sent from your domain.
Brand Protection through preventing unauthorized use of your domain. Reducing the risk of your customers falling victim to phishing attacks.
Improved email deliverability by making sure your emails are authenticated and trusted by receiving servers.
Provides visibility in a readable format helping you monitor and understand how your domain is being used and detect any unauthorized activity

What To Do Next

The end goal for any organisation implementing DMARC is to get to P=reject, but what does P=Reject even mean? In DMARC, p=reject is a policy setting that tells receiving email servers to reject any emails that fail DMARC authentication checks. This means if an email doesn’t pass the DMARC, SPF, or DKIM checks, it won’t be delivered to the recipient’s inbox at all. Instead, it will be bounced back to the sender or discarded.

Think of it like a strict bouncer at a club who doesn’t let anyone in without proper ID. If the email can’t prove it’s from a legitimate source, it gets turned away at the door. This helps protect against phishing and spoofing attacks by ensuring only verified emails are delivered.

Vendors in this space have managed to make the journey significantly easier and take away the burden from your IT team as the journey can be a long one if not completed correctly. There are many managed services who can take away the complexity and resource challenge and effectively do the heavy lifting to get you to your desired end state. Not only does this help you to free up resource for other important projects but it also ensures that the policy is implemented and configured correctly allowing you to monitor and have visibility into how your domain is being used and ensure that all legitimate mails will get through to the desired recipient.

Among the top 10 million domains. DMARC Adoption saw a significant boost during January and February 2024. By the end of February data shows that the Yahoo/Google requirements drove more than half a million of that 10 million to publish a DMARC record.

How Bytes Can Help

Bytes have several workshops available free of charge that can take you through not just the Email resilience market but also the key players in the DMARC landscape. Navigating the numerous vendors In this space can be time consuming and it can also be a significant and complex project to undertake. That is why Bytes have done analysis around the best of breed vendors in this space and can help you choose the right technology for your organisation.

Thank you for reading.

If you have any questions, or would like to learn about any of the content covered in this blog, please email our friendly team via [email protected]

Want to keep informed? Sign up to our Newsletter