Fighting Phishing

CHAPTER 7DMARC, SPF, and DKIM

Chapter 7 covers DMARC, SPF, and DKIM in detail. Anyone involved in anti-phishing activities should understand the benefits of these three anti-phishing email standards. Every organization should have all three standards implemented for both sending and receiving email.

This chapter is one of the longer chapters in this book, but it should be required reading for anyone not familiar with DMARC that is involved in fighting phishing.

The Core Concepts

Domain-based Message Authentication, Reporting and Conformance (DMARC), Sender Policy Framework (SPF), and Domain Keys Identified Mail (DKIM) are related global anti-phishing standards that allow email receivers to verify if an email that claims to be from a particular sending domain is really from the domain it claims. In short, it helps to prevent email domain spoofing. DMARC relies on SPF and DKIM. DMARC provides proactive protection even without either SPF and/or DKIM being enabled (although you’ll want both enabled to get the most complete protection).

The acronym DMARC can refer to just the DMARC standard by itself or can refer to the collection of all three related standards. Most of the time, you can figure out how it is being used depending on the overall context, although you may need to clarify that. In most of the places in this book, except in the specific DMARC section, when I use DMARC, I'm usually referring to the umbrella of all three standards.

Email senders can use DMARC to ...