Posts

Email authentication is a crucial aspect of an email provider’s job. Email authentication also known as SPF and DKIM checks the identity of an email provider. DMARC adds to the process of verifying an email by checking if an email has been sent from a legitimate domain through alignment, and specifying to receiving servers how to respond to messages failing authentication checks. Today we are going to discuss the various scenarios that would answer your query on why is DMARC failing.

DMARC is a key activity in your email authentication policy to help prevent forged “spoofed” emails from passing transactional spam filters. But, it’s just one pillar of an overall anti-spam program and not all DMARC reports are created equal. Some will tell you the exact action mail receivers took on each message, and others will only tell you if a message was successful or not. Understanding why a message failed is as important as knowing whether it did. The following article explains reasons for which messages fail DMARC authentication checks. These are the most common reasons (some of which can be easily fixed) for which messages can fail DMARC authentication checks.

Common Reasons Why Messages Can Fail DMARC

Identifying why is DMARC failing can be complicated. However I will go over some typical reasons, the factors that contribute to them, so that you as the domain owner can work towards rectifying the problem more promptly.

DMARC Alignment Failures

DMARC makes use of domain alignment to authenticate your emails. This means that DMARC verifies whether the domain mentioned in the From address (in the visible header) is authentic by matching it against the domain mentioned in the hidden Return-path header (for SPF) and DKIM signature header (for DKIM). If either matches, the email passes DMARC, or else DMARC fails.

Hence, if your emails are failing DMARC it can be a case of domain misalignment. That is neither SPF nor DKIM identifiers are aligning and the email is appearing to be sent from an unauthorized source. This however is just one of the reasons why is DMARC failing.

DMARC Alignment Mode 

Your protocol alignment mode also plays a huge role in your messages passing or failing DMARC. You can choose from the following alignment modes for SPF authentication:

  • Relaxed: This signifies that if the domain in the Return-path header and the domain in the From header is simply an organizational match, even then SPF will pass.
  • Strict: This signifies that only if the domain in the Return-path header and the domain in the From header is an exact match, only then SPF will pass.

You can choose from the following alignment modes for DKIM authentication:

  • Relaxed: This signifies that if the domain in the DKIM signature  and the domain in the From header is simply an organizational match, even then DKIM will pass.
  • Strict: This signifies that only if the domain in the DKIM signature and the domain in the From header is an exact match, only then DKIM will pass.

Note that for emails to pass DMARC authentication, either SPF or DKIM need to align.  

Not Setting Up Your DKIM Signature 

A very common case in which your DMARC may be failing is that you haven’t specified a DKIM signature for your domain. In such cases, your email exchange service provider assigns a default DKIM signature to your outbound emails that doesn’t align with the domain in your From header. The receiving MTA fails to align the two domains, and hence, DKIM and DMARC fails for your message (if your messages are aligned against both SPF and DKIM).

Not Adding Sending Sources to Your DNS 

It is important to note that when you set up DMARC for your domain, receiving MTAs perform DNS queries to authorize your sending sources. This means that unless you have all your authorized sending sources listed in your domain’s DNS, your emails will fail DMARC for those sources that are not listed, since the receiver would not be able to find them in your DNS. Hence, to ensure that your legitimate emails are always delivered be sure to make entries on all your authorized third party email vendors that are authorized to send emails on behalf of your domain, in your DNS.

In Case of Email Forwarding

During email forwarding the email passes through an intermediary server before it ultimately gets delivered to the receiving server. During email forwarding SPF check fails since the IP address of the intermediary server doesn’t match that of the sending server, and this new IP address is usually not included within the original server’s SPF record. On the contrary, forwarding emails usually don’t impact DKIM email authentication, unless the intermediary server or the forwarding entity makes certain alterations in the content of the message.

As we know that SPF inevitably fails during email forwarding, if in case the sending source is DKIM neutral and solely relies on SPF for validation, the forwarded email will be rendered illegitimate during DMARC authentication. To resolve this issue, you should immediately opt for full DMARC compliance at your organization by aligning and authenticating all outgoing messages against both SPF and DKIM, as for an email to pass DMARC authentication, the email would be required to pass either SPF or DKIM authentication and alignment.

Your Domain is Being Spoofed

If you have your DMARC, SPF and DKIM protocols properly configured for your domain, with your policies at enforcement and valid error-free records, and the problem isn’t either of the above-mentioned cases, then the most probable reason why your emails are failing DMARC is that your domain is being spoofed or forged. This is when impersonators and threat actors try to send emails that appear to be coming from your domain using a malicious IP address.

Recent email fraud statistics have concluded that email spoofing cases are on the rise in recent times and are a very big threat to your organization’s reputation. In such cases if you have DMARC implemented on a reject policy, it will fail and the spoofed email will not be delivered to your recipient’s inbox. Hence domain spoofing can be the answer to why is DMARC failing in most cases.

We recommend that you sign up with our free DMARC Analyzer and start your journey of DMARC reporting and monitoring.

  • With a none policy you can monitor your domain with DMARC (RUA) Aggregate Reports and keep a close eye on your inbound and outbound emails, this will help you respond to any unwanted delivery issues
  • After that we help you shift to an enforced policy that would ultimately aid you in gaining immunity against domain spoofing and phishing attacks
  • You can take down malicious IP addresses and report them directly from the PowerDMARC platform to evade future impersonation attacks, with the help of our Threat Intelligence engine
  • PowerDMARC’s DMARC (RUF) Forensic reports help you gain detailed information about cases where your emails have failed DMARC so that you can get to the root of the problem and fix it

Prevent domain spoofing and monitor your email flow with PowerDMARC, today!

All right, you’ve just gone through the whole process of setting up DMARC for your domain. You published your SPF, DKIM and DMARC records, you analysed all your reports, fixed delivery issues, bumped up your enforcement level from p=none to quarantine and finally to reject. You’re officially 100% DMARC-enforced. Congratulations! Now only your emails reach people’s inboxes. No one’s going to impersonate your brand if you can help it.

So that’s it, right? Your domain’s secured and we can all go home happy, knowing your emails are going to be safe. Right…?

Well, not exactly. DMARC is kind of like exercise and diet: you do it for a while and lose a bunch of weight and get some sick abs, and everything’s going great. But if you stop, all those gains you just made are slowly going to diminish, and the risk of spoofing starts creeping back in. But don’t freak out! Just like with diet and exercise, getting fit (ie. getting to 100% enforcement) is the hardest part. Once you’ve done that, you just need to maintain it on that same level, which is much easier.

Okay, enough with the analogies, let’s get down to business. If you’ve just implemented and enforced DMARC on your domain, what’s the next step? How do you continue keeping your domain and email channels secure?

What to Do After Achieving DMARC Enforcement

The #1 reason that email security doesn’t simply end after you reach 100% enforcement is that attack patterns, phishing scams, and sending sources are always changing. A popular trend in email scams often doesn’t even last longer than a couple of months. Think of the WannaCry ransomware attacks in 2018, or even something as recent as the WHO Coronavirus phishing scams in early 2020. You don’t see much of those in the wild right now, do you?

Cybercriminals are constantly changing their tactics, and malicious sending sources are always changing and multiplying, and there’s not much you can do about it. What you can do is prepare your brand for any possible cyberattack that could come at you. And the way to do that is through DMARC monitoring & visibility .

Even after you’re enforced, you still need to be in total control of your email channels. That means you have to know which IP addresses are sending emails through your domain, where you’re having issues with email delivery or authentication, and identify and respond to any potential spoofing attempt or malicious server carrying a phishing campaign on your behalf. The more you monitor your domain, the better you’ll come to understand it. And consequently, the better you’ll be able to secure your emails, your data and your brand.

Why DMARC Monitoring is So Important

Identifying new mail sources
When you monitor your email channels, you’re not just checking to see if everything’s going okay. You’re also going to be looking for new IPs sending emails from your domain. Your organization might change its partners or third party vendors every so often, which means their IPs might become authorized to send emails on your behalf. Is that new sending source just one of your new vendors, or is it someone trying to impersonate your brand? If you analyse your reports regularly, you’ll have a definite answer to that.

PowerDMARC lets you view your DMARC reports according to every sending source for your domain.

Understanding new trends of domain abuse
As I mentioned earlier, attackers are always finding new ways to impersonate brands and trick people into giving them data and money. But if you only ever look at your DMARC reports once every couple of months, you’re not going to notice any telltale signs of spoofing. Unless you regularly monitor the email traffic in your domain, you won’t notice trends or patterns in suspicious activity, and when you are hit with a spoofing attack, you’ll be just as clueless as the people targeted by the email. And trust me, that’s never a good look for your brand.

Find and blacklist malicious IPs
It’s not enough just to find who exactly is trying to abuse your domain, you need to shut them down ASAP. When you’re aware of your sending sources, it’s much easier to pinpoint an offending IP, and once you’ve found it, you can report that IP to their hosting provider and have them blacklisted. This way, you permanently eliminate that specific threat and avoid a spoofing attack.

With Power Take Down, you find the location of a malicious IP, their history of abuse, and have them taken down.

Control over deliverability
Even if you were careful to bring DMARC up to 100% enforcement without affecting your email delivery rates, it’s important to continuously ensure consistently high deliverability. After all, what’s the use of all that email security if none of the emails are making it to their destination? By monitoring your email reports, you can see which ones passed, failed or didn’t align with DMARC, and discover the source of the problem. Without monitoring, it would be impossible to know if your emails are being delivered, let alone fix the issue.

PowerDMARC gives you the option of viewing reports based on their DMARC status so you can instantly identify which ones didn’t make it through.

 

Our cutting-edge platform offers 24×7 domain monitoring and even gives you a dedicated security response team that can manage a security breach for you. Learn more about PowerDMARC extended support.

At first glance, Microsoft’s Office 365 suite seems to be pretty…sweet, right? Not only do you get a whole host of productivity apps, cloud storage, and an email service, but you’re also protected from spam with Microsoft’s own email security solutions. No wonder it’s the most widely adopted enterprise email solution available, with a 54% market share and over 155 million active users. You’re probably one of them, too.

But if a cybersecurity company’s writing a blog about Office 365, there’s got to be something more to it, right? Well, yeah. There is. So let’s talk about what exactly the issue is with Office 365’s security options, and why you really need to know about this.

What Microsoft Office 365 Security is Good At

Before we talk about the problems with it, let’s first quickly get this out of the way: Microsoft Office 365 Advanced Threat Protection (what a mouthful) is quite effective at basic email security. It will be able to stop spam emails, malware, and viruses from making their way into you inbox.

This is good enough if you’re only looking for some basic anti-spam protection. But that’s the problem: low-level spam like this usually doesn’t pose the biggest threat. Most email providers offer some form of basic protection by blocking email from suspicious sources. The real threat—the kind that can make your organization lose money, data and brand integrity—are emails carefully engineered so you don’t realize that they’re fake.

This is when you get into serious cybercrime territory.

What Microsoft Office 365 Can’t Protect You From

Microsoft Office 365’s security solution works like an anti-spam filter, using algorithms to determine if an email is similar to other spam or phishing emails. But what happens when you’re hit with a far more sophisticated attack using social engineering, or targeted at a specific employee or group of employees?

These aren’t your run-of-the-mill spam emails sent out to tens of thousands of people at once. Business Email Compromise (BEC) and Vendor Email Compromise (VEC) are examples of how attackers carefully select a target, learn more information about their organization by spying on their emails, and at a strategic point, send a fake invoice or request via email, asking for money to be transferred or data to be shared.

This tactic, broadly known as spear phishing, makes it appear that email is coming from someone within your own organization, or a trusted partner or vendor. Even under careful inspection, these emails can look very realistic and are nearly impossible to detect, even for seasoned cybersecurity experts.

If an attacker pretends to be your boss or the CEO of your organization and sends you an email, it’s unlikely that you’ll check to see if the email looks genuine or not. This is exactly what makes BEC and CEO fraud so dangerous. Office 365 will not be able to protect you against this sort of attack because these are ostensibly coming from a real person, and the algorithms will not consider it to be a spam email.

How Can You Secure Office 365 Against BEC and Spear Phishing?

Domain-based Message Authentication, Reporting & Conformance, or DMARC, is an email security protocol that uses information provided by the domain owner to protect receivers from spoofed email. When you implement DMARC on your organization’s domain, receiving servers will check each and every email coming from your domain against the DNS records you published.

But if Office 365 ATP couldn’t prevent targeted spoofing attacks, how does DMARC do it?

Well, DMARC functions very differently than an anti-spam filter. While spam filters check incoming email entering your inbox, DMARC authenticates outgoing email sent by your organization’s domain. What this means is that if someone is trying to impersonate your organization and send you phishing emails, as long as you’re DMARC-enforced, those emails will be dumped in the spam folder or blocked entirely.

And get this — it also means that if a cybercriminal was using your trusted brand to send phishing emails, even your customers wouldn’t have to deal with them, either. DMARC actually helps protect your business, too.

But there’s more: Office 365 doesn’t actually give your organization any visibility on a phishing attack, it just blocks spam email. But if you want to properly secure your domain, you need to know exactly who or what is trying to impersonate your brand, and take immediate action. DMARC provides this data, including the IP addresses of abusive sending sources, as well as the number of emails they send. PowerDMARC takes this to the next level with advanced DMARC analytics right on your dashboard.

Learn more about what PowerDMARC can do for your brand.

 

As organisations set up charity funds around the world to fight Covid-19, a different sort of battle is being waged in the electronic conduits of the internet. Thousands of people around the world have fallen prey to email spoofing and covid-19 email scams during the coronavirus pandemic. It’s become increasingly common to see cybercriminals use real domain names of these organisations in their emails to appear legitimate.

In the most recent high-profile coronavirus scam, an email supposedly from the World Health Organization (WHO) was sent around the world, requesting donations to the Solidarity Response Fund. The sender’s address was ‘[email protected]’, where ‘who.int’ is the real domain name for WHO. The email was confirmed to be a phishing scam, but at first glance, all signs pointed to the sender being genuine. After all, the domain belonged to the real WHO.

donate response fund

However, this has only been one in a growing series of phishing scams that use emails related to coronavirus to steal money and sensitive information from people. But if the sender is using a real domain name, how can we distinguish a legitimate email from a fake one? Why are cybercriminals so easily able to employ email domain spoofing on such a large organisation?

And how do entities like WHO find out when someone is using their domain to launch a phishing attack?

Email is the most widely used business communication tool in the world, yet it’s a completely open protocol. On its own, there’s very little to monitor who sends what emails and from which email address. This becomes a huge problem when attackers disguise themselves as a trusted brand or public figure, asking people to give them their money and personal information. In fact, over 90% of all company data breaches in recent years have involved email phishing in one form or the other. And email domain spoofing is one of the leading causes of it.

In an effort to secure email, protocols like Sender Policy Framework (SPF) and Domain Keys Identified Mail (DKIM) were developed. SPF cross-checks the sender’s IP address with an approved list of IP addresses, and DKIM uses an encrypted digital signature to protect emails. While these are both individually effective, they have their own set of flaws. DMARC, which was developed in 2012, is a protocol that uses both SPF and DKIM authentication to secure email, and has a mechanism that sends the domain owner a report whenever an email fails DMARC validation.

This means the domain owner is notified whenever an email sent by an unauthorised third party. And crucially, they can tell the email receiver how to handle unauthenticated mail: let it go to inbox, quarantine it, or reject it outright. In theory, this should stop bad email from flooding people’s inboxes and reduce the number of phishing attacks we face. So why doesn’t it?

Can DMARC Prevent Domain Spoofing and Covid-19 Email Scams?

Email authentication requires sender domains to publish their SPF, DKIM and DMARC records to DNS. According to a study, only 44.9% of Alexa top 1 million domains had a valid SPF record published in 2018, and as little as 5.1% had a valid DMARC record. And this is despite the fact that domains without DMARC authentication suffer from spoofing nearly four times as much as domains that are secured. There’s a lack of serious DMARC implementation across the business landscape, and it’s not gotten much better over the years. Even organisations like UNICEF have yet to implement DMARC with their domains, and the White House and US Department of Defense both have a DMARC policy of p = none, which means they’re not being enforced.

A survey conducted by experts at Virginia Tech has brought to light some of the most serious concerns cited by major companies and businesses that have yet to use DMARC authentication:

  1. Deployment Difficulties: The strict enforcement of security protocols often means a high level of coordination in large institutions, which they often don’t have the resources for. Beyond that, many organisations don’t have much control over their DNS, so publishing DMARC records becomes even more challenging.
  2. Benefits Not Outweighing the Costs: DMARC authentication typically has direct benefits to the recipient of the email rather than the domain owner. The lack of serious motivation to adopt the new protocol has kept many companies from incorporating DMARC into their systems.
  3. Risk of Breaking the Existing System: The relative newness of DMARC makes it more prone to improper implementation, which brings up the very real risk of legitimate emails not going through. Businesses that rely on email circulation can’t afford to have that happening, and so don’t bother adopting DMARC at all.

Recognising Why We Need DMARC

While the concerns expressed by businesses in the survey have obvious merit, it doesn’t make DMARC implementation any less imperative to email security. The longer businesses continue to function without a DMARC-authenticated domain, the more all of us expose ourselves to the very real danger of email phishing attacks. As the coronavirus email spoofing scams have taught us, no one is safe from being targeted or impersonated. Think of DMARC as a vaccine — as the number of people using it grows, the chances of catching an infection go down dramatically.

There are real, viable solutions to this problem that might overcome people’s concerns over DMARC adoption. Here are just a few that could boost implementation by a large margin:

  1. Reducing Friction in Implementation: The biggest hurdle standing in the way of a company adopting DMARC are the deployment costs associated with it. The economy is in the doldrums and resources are scarce. This is why PowerDMARC along with our industrial partners Global Cyber Alliance (GCA) are proud to announce a limited-time offer during the Covid-19 pandemic — 3 months of our full suite of apps, DMARC implementation and anti-spoofing services, completely free. Get your DMARC solution set up in minutes and start monitoring your emails using PowerDMARC now.
  2. Improving Perceived Usefulness: For DMARC to have a major impact on email security, it needs a critical mass of users to publish their SPF, DKIM and DMARC records. By rewarding DMARC-authenticated domains with a ’Trusted’ or ‘Verified’ icon (like with the promotion of HTTPS among websites), domain owners can be incentivised to get a positive reputation for their domain. Once this reaches a certain threshold, domains protected by DMARC will be viewed more favourably than ones that aren’t.
  3. Streamlined Deployment: By making it easier to deploy and configure anti-spoofing protocols, more domains will be agreeable to DMARC authentication. One way this could be done is by allowing the protocol to run in a ’Monitoring mode’, allowing email administrators to assess the impact it has on their systems before going for a full deployment.

Every new invention brings with it new challenges. Every new challenge forces us to find a new way to overcome it. DMARC has been around for some years now, yet phishing has existed for far longer. In recent weeks, the Covid-19 pandemic has only given it a new face. At PowerDMARC, we’re here to help you meet this new challenge head-on. Sign up here for your free DMARC analyzer, so that while you stay home safe from coronavirus, your domain is safe from email spoofing.