DMARC (Domain-based Message Authentication, Reporting & Conformance) is a widely recognized email protocol, which helps people and businesses protect their email addresses and domains from being misused by third parties.
It helps identify that an email you send comes from the real you. This method of email authentication protects both senders and recipients from activities like spamming, phishing, and spoofing.
In this guide, you will learn more about DMARC and how to make your emails DMARC compliant.
DMARC uses Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) to evaluate the authenticity of email messages. Together, these tools prevent activities like phishing and domain spoofing.
Phishing is a cybercrime in which someone poses as a credible entity, like a governmental agency or a bank or even your own employ, to try and gather sensitive information (i.e., credit card information or social security number). Meanwhile, domain spoofing is a form of phishing that entails using a fake domain or email address to appear legitimate.
DMARC lets domain owners define how an email that appears to be sent from that domain gets handled if it doesn't include the right information. For instance, unauthenticated emails can be blocked or sent straight to a junk folder based on settings placed in the records for that email address's domain.
The importance of DMARC
Phishers and spammers have a lot to gain from compromising user accounts. By gaining access to passwords, credit card information, bank accounts, and other financial instruments, malicious actors can easily get access to their victims' money before their victims are even aware they have been scammed.
Email is a particularly common and attractive target, especially for spoofing. Even something as simple as inserting the logo of a well-known brand into an email can trick some recipients into believing they have been sent a legitimate communication.
DMARC works to solve this problem at scale. Realistically, free email services like Yahoo, Google, or Hotmail can't inspect every email that passes through their servers to determine which ones to allow and which ones may be fraudulent.
SPF and DKIM records can actually help, but these processes have limited scope on their own. When used with DMARC, these protocols help senders and receivers collaborate to better secure emails.
DMARC provides 3 main benefits: security, reputation, and visibility.
- Security. Along with protecting customers, using DMARC benefits the email community as a whole. By building a framework for a consistent policy to deal with unauthenticated emails, DMARC helps the email ecosystem become more trustworthy and secure.
- Reputation. DMARC protects businesses by serving as a gatekeeper - it prevents bad actors from spoofing your domain and sending out emails that appear to come from your brand. Publishing your DMARC record can result in a boost to your reputation.
- Visibility. DMARC gives you more insight into your email program at a high level, allowing you to know the identity of everyone who sends email from your domain.
To understand DMARC, it is essential to understand the fundamentals of SPF and DKIM as well as DNS (Domain Name System) records. DMARC builds on SPF and DKIM techniques.
SPF helps detect forgery by reviewing an email's listed return-path address. This email address is also referred to as the Mail From or the bounce address. When an email can't be sent to its intended recipient after a delay or several attempts, a notification of that failure is often sent to the return-path address.
DKIM is an email authentication technique that ensures that email content is kept safe from tempering, using an encrypted digital signature. DKIM signatures are added as headers to email messages and secured with public key cryptography.
When a receiving server determines that an email has a valid DKIM signature, it can confirm that the email and attachments have not been modified. This process is not typically visible to end users such as the intended recipient of the email message.
A record (address record) is a type of DNS record that points domains to an IP address. When using IPv4 addresses, this record is referred to as an A record.
If you were to visit avada.io, your browser would ask a nearby DNS server if it has the IP address of avada.io. If it has the IP on record, it sends it to your browser. If not, it tells your browser where it can find another DNS server that has it, and so on until the IP is relayed to you along with the website.
A CNAME (Canonical Name) record is a type of DNS record that maps an alias name to a true (canonical) domain name. CNAME records often map a subdomain like "www" or "mailto:" to the domain that hosts that subdomain's content. For instance, a CNAME record can map the web address www.avada.io to the website for the domain avada.io.
You can add a CNAME record to your DNS settings if you would like to customize a web address, verify domain ownership, reset your admin password, and much more.
How does DMARC influence email marketing?
Problem: If you send mass emails with any third-party email marketing platform (not only AVADA) and use Gmail, Yahoo, Outlook, AOL, Hotmail, MSN, or Live email addresses as the sender's email address, your emails will be bounced (not delivered) or delivered to spam boxes.
Because the emails you sent were from servers of your email marketing platform, instead of from a Gmail, Yahoo, Outlook, AOL, Hotmail, MSN, or Live server. As a result, email marketing campaigns will not reach your audiences and generate less revenue.
What is the solution for email marketers?
The best way to boost email deliverability is using a business email sender that is verified with your business domain. Let's say, our business domain is avada.io. We should verify this domain in the third party email marketing platform, then we can confidently use an email with this domain as an authorized sender, like firstname.lastname@example.org, email@example.com.
You can see the detailed guide right here.
If you're running a business and sending emails to your customers, whether transactional or promotional emails, it's essential to verify them.
Creating a professional email address will serve both purposes - email deliverability as well as marketing and credibility in front of your customers.
In AVADA, we do offer different ways for you to verify a sender:
- You can use your sender under our verified domain
- You can verify your own domain and add a sender belong to it
- You can set up a custom SMTP sender if you're using SMTP service to send emails
All of these methods are compliant with the DMARC policy, and ensure you can send emails without worrying they are not delivered to your customers.
DMARC is undoubtedly a robust technique for reducing the likelihood of email phishing and spoofing, but it does have a few limitations.
One of the most significant is that it can't combat spear phishing attacks using DNI (Display Name Imposters), which make up a large percentage of email fraud attempts.
Besides, DMARC is unable to protect against lookalike domain spoofs, DMARC should be used in conjunction with other protocols for protection against email fraud.
DMARC is complicated, as well. Companies with large IT talent pools have an advantage here. However, there are many resources out there to teach anyone how to deploy DMARC. It may be a large time commitment, but domain owners who want to mitigate vulnerabilities in their email systems will find it worthwhile to put in the time.
It is hard to say how many organizations will ultimately use DMARC, though the numbers are steadily growing. Considering that the vast majority of successful data breaches originate with email, though, it is clear that we will all be better off when DMARC usage is widespread.
Updated on: 28/08/2021
DMARC (Domain-Based Message Authentication, Reporting & Conformance) ni itifaki ya barua pepe inayotambuliwa sana ambayo husaidia watu na biashara kulinda anwani zao za barua pepe na vikoa kutoka kwa matumizi mabaya na watu wa tatu. Hii inasaidia kutambua kwamba barua pepe unayotuma inatokana na wewe halisi. Njia hii ya uthibitisho wa barua pepe inalinda wote watumaji na wapokeaji kutoka kwa shughuli kama vile spam, phishing, na spoofing. Katika mwongozo huu, utajifunza zaidi juu ya DMARC na jinsi ya kufanya barua pepe zako ziwe na kufuata DMARC. DMARC hutumia Sender Policy Framework (SPF) na DomainKeys Identified Mail (DKIM) kutathmini uhalisi wa ujumbe wa barua pepe. Pamoja, zana hizi kuzuia shughuli kama vile phishing na spoofing uwanja. Phishing ni uhalifu wa mtandao ambapo mtu hujifanya kuwa mtu wa kuaminika, kama shirika la serikali au benki au hata mfanyakazi wako mwenyewe, kujaribu na kukusanya habari nyeti (yaani, habari ya kadi ya mkopo au nambari ya usalama wa kijamii). Domain spoofing ni aina ya udanganyifu wa phishing ambayo inahusisha kutumia jina la kikoa bandia au anwani ya barua pepe kuonekana halali. DMARC inaruhusu wamiliki wa kikoa kuamua jinsi barua pepe inayoonekana kutumwa kutoka kikoa hicho inashughulikiwa ikiwa haijumuishi habari sahihi. Kwa mfano, barua pepe zisizo na uthibitisho zinaweza kuzuiwa au kutumwa moja kwa moja kwenye folda ya junk kulingana na mipangilio iliyowekwa katika rekodi za kikoa cha anwani hiyo ya barua pepe. Phishers na spammers wana faida kubwa kutoka kwa kuhatarisha akaunti za watumiaji. Kwa kupata nywila, habari za kadi za mkopo, akaunti za benki, na vifaa vingine vya kifedha, watendaji wa uovu wanaweza kupata pesa za waathirika wao kabla ya waathirika wao hata kujua wamedanganywa. Barua pepe ni lengo la kawaida na la kuvutia, hasa kwa udanganyifu. Hata kitu rahisi kama kuingiza nembo ya chapa inayojulikana katika barua pepe inaweza kuwafanya wapokeaji waamini wamepokea mawasiliano halali. DMARC inafanya kazi ili kutatua tatizo hili kwa kiwango kikubwa. Kwa kweli, huduma za barua pepe za bure kama Yahoo, Google, au Hotmail haziwezi kukagua kila barua pepe inayopita kupitia seva zao ili kuamua ni ipi inayoruhusiwa na ni ipi ambayo inaweza kuwa ya udanganyifu. SPF na DKIM rekodi inaweza kusaidia, lakini taratibu hizi zina kikomo wigo wao wenyewe. Wakati kutumika na DMARC, itifaki hizi kusaidia watumaji na wapokeaji kushirikiana kwa bora salama barua pepe. DMARC hutoa faida kuu tatu: usalama, sifa, na kuonekana. - Usalama. Pamoja na kulinda wateja, kutumia DMARC inasaidia jamii ya barua pepe kwa ujumla. Kwa kujenga mfumo wa sera thabiti ya kushughulikia barua pepe zisizo na uthibitisho, DMARC husaidia mfumo wa barua pepe kuwa wa kuaminika na salama zaidi. - Sifa nzuri. DMARC inalinda biashara kwa kutumika kama mlinda mlango - inazuia waigizaji wabaya kutoka kwa kudanganya kikoa chako na kutuma barua pepe ambazo zinaonekana kuja kutoka kwa chapa yako. Kuchapisha rekodi yako ya DMARC kunaweza kusababisha kuongeza sifa yako. - Uwezo wa kuona. DMARC inatoa ufahamu zaidi katika programu yako ya barua pepe katika kiwango cha juu, ikikuruhusu kujua utambulisho wa kila mtu anayetuma barua pepe kutoka kwa kikoa chako. Kwa hivyo, ni muhimu kuelewa msingi wa SPF na DKIM na rekodi za DNS. DMARC inajenga juu ya SPF na mbinu DKIM. SPF inasaidia kugundua udanganyifu kwa kukagua anwani ya njia ya kurudi iliyoorodheshwa ya barua pepe. Anwani hii ya barua pepe pia inajulikana kama Mail From au anwani ya bounce. Wakati barua pepe haiwezi kutumwa kwa mpokeaji wake aliyokusudiwa baada ya kucheleweshwa au majaribio kadhaa, taarifa ya kushindwa hiyo mara nyingi hutumwa kwa anwani ya njia ya kurudi. DKIM ni mbinu ya uthibitisho wa barua pepe ambayo inahakikisha kuwa yaliyomo kwenye barua pepe yanahifadhiwa salama kutoka kwa tempering, kwa kutumia saini ya dijiti iliyofichwa. Saini za DKIM huongezwa kama vichwa vya ujumbe wa barua pepe na kuhifadhiwa kwa encryption ya ufunguo wa umma. Wakati server kupokea huamua kwamba barua pepe ina sahihi DKIM saini, inaweza kuthibitisha kwamba barua pepe na viambatisho havijabadilishwa. Utaratibu huu kwa kawaida hauonekani kwa watumiaji wa mwisho kama vile mpokeaji aliyekusudiwa wa ujumbe wa barua pepe. Rekodi (rekodi ya anwani) ni aina ya rekodi ya DNS ambayo inaelekeza vikoa kwa anwani ya IP. Wakati wa kutumia anwani IPv4, rekodi hii inajulikana kama rekodi A. Ikiwa utaenda kwa Avada.io, kivinjari chako kitauliza seva ya DNS iliyo karibu ikiwa ina anwani ya IP ya Avada.io. Ikiwa IP imeandikwa, inatumwa kwa kivinjari chako. Ikiwa sio, inawambia kivinjari chako ambapo inaweza kupata seva nyingine ya DNS ambayo ina, na kadhalika hadi IP itakapopitishwa kwako pamoja na wavuti. CNAME (Canonical Name) rekodi ni aina ya rekodi ya DNS ambayo ramani jina alias kwa jina la kikoa kweli (canonical). "CNAME rekodi mara nyingi ramani subdomain kama ""www"" au ""mailto"" kwa uwanja kwamba mwenyeji kwamba subdomain ya maudhui." Kwa mfano, rekodi ya CNAME inaweza ramani anwani ya wavuti www.avada.io kwa tovuti ya uwanja avada.io. Unaweza kuongeza rekodi ya CNAME kwenye mipangilio yako ya DNS ikiwa ungependa kubadilisha anwani ya wavuti, kuthibitisha umiliki wa kikoa, kuweka upya nenosiri lako la msimamizi, na mengi zaidi. DMARC inasaidiaje uuzaji wa barua pepe? Ikiwa unatuma barua pepe nyingi na jukwaa lolote la uuzaji wa barua pepe la mtu wa tatu (si AVADA tu) na unatumia anwani za Gmail, Yahoo, Outlook, AOL, Hotmail, MSN au Live kama anwani ya barua pepe ya mtumaji, barua pepe zako zitarudishwa (si kutolewa) au kutolewa kwenye sanduku la spam. Kwa sababu barua pepe ulizotuma zilitoka kwa seva za jukwaa lako la uuzaji wa barua pepe, badala ya kutoka kwa seva ya Gmail, Yahoo, Outlook, AOL, Hotmail, MSN, au Live. Kama matokeo, kampeni za uuzaji wa barua pepe hazitafikia watazamaji wako na kuzalisha mapato machache. Ni nini cha kufanya kwa wauzaji wa barua pepe? Njia bora ya kuongeza utoaji wa barua pepe ni kutumia mtumaji wa barua pepe ya biashara ambayo imethibitishwa na kikoa chako cha biashara. Kwa mfano, jina la kikoa la biashara yetu ni avada.io. Kwa hivyo, ikiwa unafanya hivyo, unapaswa kuamua kutumia tovuti ya wavuti ya mtu wa tatu, ambayo inatoa chaguo la kuagiza kwa jina la kikoa, kama vile jina la kwanza, jina la mwisho, mfano, au mfano. Unaweza kuona mwongozo wa kina hapa. Ikiwa unaendesha biashara na kutuma barua pepe kwa wateja wako, iwe ni barua pepe za shughuli au za uendelezaji, ni muhimu kuithibitisha. Kuunda anwani ya barua pepe ya kitaaluma itatumikia malengo yote mawili - uwasilishaji wa barua pepe na pia uuzaji na uaminifu mbele ya wateja wako. AVADA inatoa njia tofauti za kuthibitisha mtumaji: Unaweza kutumia mtumaji wako chini ya kikoa chetu kilichothibitishwa, unaweza kuthibitisha kikoa chako mwenyewe na kuongeza mtumaji anayemilikiwa na AVADA, unaweza kuanzisha mtumaji wa SMTP wa kawaida ikiwa unatumia huduma ya SMTP kutuma barua pepe. DMARC ni mbinu ya kuokoa na kupunguza uwezekano wa phishing na spoofing, lakini ina mapungufu. "Kama ilivyoelezwa hapo juu, ""Hakuna uwezekano wa kupambana na mashambulizi ya spear phishing kwa kutumia DNI (Disclosure Name Imposters), ambayo hufanyiza asilimia kubwa ya majaribio ya udanganyifu wa barua pepe.""" Kwa kuongezea, DMARC haiwezi kulinda dhidi ya udanganyifu wa kikoa sawa, DMARC inapaswa kutumika pamoja na itifaki zingine za ulinzi dhidi ya udanganyifu wa barua pepe. DMARC ni ngumu sana. Kampuni zilizo na vikundi vikubwa vya vipaji vya IT zina faida hapa. Hata hivyo, kuna rasilimali nyingi huko nje kufundisha mtu yeyote jinsi ya kupeleka DMARC. Inaweza kuwa ahadi kubwa ya muda, lakini wamiliki wa kikoa ambao wanataka kupunguza udhaifu katika mifumo yao ya barua pepe wataona ni muhimu kuweka katika wakati. Ni vigumu kusema ni mashirika mangapi yatakayotumia DMARC, ingawa idadi hiyo inaongezeka. Kwa kuzingatia kwamba idadi kubwa ya uvunjaji wa data unaofanikiwa hutokana na barua pepe, ingawa, ni wazi kwamba sisi sote tutakuwa bora wakati matumizi ya DMARC ni kuenea. Imeandikwa na: 28th Aprili, 2021