How DMARC Advances Email Security

While some identity management protocols such as multi-factor authentication have made modern advancements, others – like email authentication – have remained stuck in the 90s. Yet, email remains one of the most common forms of communication for business and personal use. That also makes it a target for cybercriminals who often use email to conduct phishing attacks. DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a policy that helps protect organizations by validating email senders. It’s like an identity check for your organization’s domain.

DMARC is an email authentication, policy, and reporting protocol. Implementing DMARC identifies spoofed phishing emails from cybercriminals by validating the sender’s identity. DMARC allows senders to show that their messages are protected, and tells the recipient what to do if an authentication method fails. It was started in 2012 in an effort to combat email fraud and provide reporting on authentication. Today, it’s used by major organizations and websites including Gmail, Facebook, and Microsoft.

Implementing a DMARC policy allows senders to indicate that their email messages are protected, and tells the recipient what to do if authentication fails (such as reject the message or send it to the “junk” folder). In technical terms, DMARC uses SPF and DKIM to validate the identity of an email message. Then, it follows a set of rules to deliver “validated” messages and reject or quarantine “spoofed” ones. This minimizes the number of potentially malicious messages (phishing, spoofed, spam) making it to your inbox. Over 4.8 billion inboxes worldwide are currently protected by DMARC policies, according to the Global Cyber Alliance.

Implementing a DMARC policy protects against direct domain spoofing, a common vector for phishing attacks. However, it cannot block all types of phishing, such as cousin domain attacks which use lookalike domains (c1security.org vs cisecurity.org, for example) or display name abuse. DMARC can also help with:
• Brand protection, by preventing spammers and phishers from using valid organization names
• Increasing deliverability of valid messages
• Visibility, with reports that provide information on unauthorized systems sending email using the organization’s domain