Posts

Can DKIM work without SPF?

In the world of email authentication, we come across fleeting terms like SPF and DKIM. While both SPF and DKIM are email authentication protocols, they work in different ways to ultimately protect your email from spam and impersonation. But can DKIM work without SPF? The answer is yes, it can. As independent protocols, they do not rely on one another for their functionalities and can be implemented without the other being set up for the same domains.

In this article, we would analyze in-depth how DKIM and SPF work so you can select which protocol suits you best, and also provide our expert recommendations at the end. Let’s get started!

What is SPF and how does it protect your emails?

SPF (Sender Policy Framework) allows you to specify which mail servers are permitted to send an email on behalf of your domain or subdomain. An SPF record is a type of DNS record used to validate an email sender’s domain name and to specify which hosts are authorized to send emails on behalf of the domain.

SPF was designed to prevent unauthorized users from sending outbound mail from a different domain than their own, often referred to as “spoofing.” In addition, if an organization has multiple mail servers that accept mail for the same domain, an SPF record helps recipient email systems determine which server to receive incoming mail from. It is one of the most widely used email authentication methods deployed by novices and aficionados alike.

What is DKIM and how does it protect your emails?

DomainKeys Identified Mail (DKIM) is an email authentication method that proves an email was authorized by the owner of that domain.This is done by giving the email a digital signature, using a cryptographic algorithm and key.

Using DKIM, your server will sign all outgoing messages, including email marketing campaigns. This allows recipients of your email to verify your identity so they can trust that your messages were not altered in any way. When you sign a message using DKIM, you attach your private key to the value of a hash function of the complete email header and body. The private key used for signing can only be accessed by authorized senders.

Do I need both DKIM and SPF to configure DMARC for my domain?

Well, no. You can implement DMARC even if you have either SPF or DKIM set up for your domain. This is because for your emails to pass DMARC alignment, either DKIM or SPF needs to pass alignment for them and not both. Hence, configuring either of two protocols is enough for you to start with your DMARC deployment endeavor.

However, if your question is whether DMARC implementation is a necessary step when you have already set up DKIM or SPF for your domains, the answer is yes. With DMARC you can control the way your recipients respond to fake emails that appear to be coming from your domain, thereby saving your company’s reputation and credibility and also your clients from falling prey to phishing attacks. Neither DKIM nor SPF alone can protect organizations from social engineering attacks like spoofing, you need DMARC for that.

Generate DMARC record now for free to stop spoofing!

What do the experts recommend: Can DKIM work without SPF?

To gain 100% DMARC compliance, we recommend that you align your emails against both DKIM and SPF authentication protocols instead of just one. In certain exceptional cases such as mailing lists and forwarded emails, due to the involvement of intermediary servers, SPF inevitably fails for those emails. If your mailing system is solely dependent on SPF for authentication, legitimate emails may get lost in transit and fail delivery in the aforementioned cases. Hence, having both protocols in place is always a safer option to ensure smoother deliverability and an additional layer of email security.

Want to try out DMARC for yourself? Get a free DMARC trial for your domains now with a simple sign-up!

/by

How to Leverage Email Authentication Solutions (SPF, DKIM, and DMARC) to Stop Email Spoofing?

Email authentication standards: SPF, DKIM, and DMARC are showing promise in cutting down on email spoofing attempts and improving email deliverability. While differentiating spoofed (fake) emails from legitimate ones, email authentication standards go further in distinguishing if an email is legitimate by verifying the identity of the sender.

As more organizations adopt these standards, the overall message of trust and authority in email communication will begin to reassert itself. Every business that depends on email marketing, project requests, financial transactions, and the general exchange of information within or across companies needs to understand the basics of what these solutions are designed to accomplish and what benefits they can get out of them.

What is Email Spoofing?

Email spoofing is a common cybersecurity issue encountered by businesses today. In this article, we will understand how spoofing works and the various methods to fight it. We will learn about the three authentication standards used by email providers − SPF, DKIM, and DMARC to stop it from happening.

Email spoofing can be classified as an advanced social engineering attack that uses a combination of sophisticated techniques to manipulate the messaging environment and exploit legitimate features of email. These emails will often appear entirely legitimate, but they are designed with the intention of gaining access to your information and/or resources. Email spoofing is used for a variety of purposes ranging from attempts to commit fraud, to breach security, and even to try to gain access to confidential business information. As a very popular form of email forgery, spoofing attacks aim to deceive recipients into believing that an email was sent from a business they use and can trust, instead of the actual sender. As emails are increasingly being sent and received in bulk, this malicious form of email scam has increased dramatically in recent years.

How can Email Authentication Prevent Spoofing?

Email authentication helps you verify email sending sources with protocols like SPF, DKIM, and DMARC to prevent attackers from forging domain names and launch spoofing attacks to trick unsuspecting users. It provides verifiable information on email senders that can be used to prove their legitimacy and specify to receiving MTAs what to do with emails that fail authentication.

Hence, to enlist the various benefits of email authentication, we can confirm that SPF, DKIM, and DMARC aid in:

  • Protecting your domain from phishing attacks, domain spoofing, and BEC
  • Providing granular information and insights on email sending sources
  • Improving domain reputation and email deliverability rates
  • Preventing your legitimate emails from being marked as spam

How Do SPF, DKIM, and DMARC Work Together to Stop Spoofing?

Sender Policy Framework

SPF is an email authentication technique used to prevent spammers from sending messages on behalf of your domain. With it, you can publish authorized mail servers, giving you the ability to specify which email servers are permitted to send emails on behalf of your domain. An SPF record is stored in the DNS, listing all the IP addresses that are authorized to send mail for your organization.

If you want to leverage SPF in a way that would ensure its proper functioning, you need to ensure that SPF doesn’t break for your emails. This could happen in case you exceed the 10 DNS lookup limit, causing SPF permerror. SPF flattening can help you stay under the limit and authenticate your emails seamlessly.

DomainKeys Identified Mail

Impersonating a trusted sender can be used to trick your recipient into letting their guard down. DKIM is an email security solution that adds a digital signature to every message that comes from your customer’s inbox, allowing the receiver to verify that it was indeed authorized by your domain and enter your site’s trusted list of senders.

DKIM affixes a unique hash value, linked to a domain name, to each outgoing email message, allowing the receiver to check that an email claiming to have come from a specific domain was indeed authorized by the owner of that domain or not. This ultimately helps to pick up on spoofing attempts.

Domain-based Message Authentication, Reporting and Conformance

Simply implementing SPF and DKIM can help verify sending sources but isn’t effective enough to stop spoofing on their own. In order to stop cybercriminals from delivering fake emails to your recipients, you need to implement DMARC today. DMARC helps you align email headers to verify email From addresses, exposing spoofing attempts and fraudulent use of domain names. Moreover, it gives domain owners the power to specify to email receiving servers how to respond to emails failing SPF and DKIM authentication. Domain owners can choose to deliver, quarantine, and reject fake emails based on the degree of DMARC enforcement they need.

Note: Only a DMARC policy of reject allows you to stop spoofing.

Additionally, DMARC also offers a reporting mechanism to provide domain owners with visibility on their email channels and authentication results. By configuring your DMARC report analyzer, you can monitor your email domains on a regular basis with detailed information on email sending sources, email authentication results, geolocations of fraudulent IP addresses, and the overall performance of your emails. It helps you parse your DMARC data into an organized and readable format, and take action against attackers faster.

Ultimately, SPF, DKIM, and DMARC can work together to help you catapult your organization’s email security to new heights, and stop attackers from spoofing your domain name to safeguard your organization’s reputation and credibility.

/by

How to fix “No SPF record found” ?

If you are on this page reading this blog, chances are that you have come across either one of the following prompts:

  • No SPF record found
  • SPF record is missing
  • No SPF record
  • SPF record not found
  • No SPF record published
  • Unable to find SPF record

The prompt simply signifies that your domain is not configured with SPF email authentication standard. An SPF record is a DNS TXT record that is published in your domain’s DNS to authenticate messages by checking them against the authorized IP addresses that are allowed to send emails on behalf of your domain, included in your SPF record. So naturally if your domain is not authenticated with SPF protocol you might come across a “No SPF record found” message.

What is Sender Policy Framework (SPF)?

SPF email authentication standard is a mechanism used to prevent spammers from forging emails. It uses DNS records to verify that the sending server is allowed to send emails from the domain name.  SPF, which stands for Sender Policy Framework, allows you to identify permitted senders of emails on your domain.

SPF is a “path-based” authentication system, implying that it is related to the path that the email takes from the original sending server to the receiving server. SPF not only allows organizations to authorize IP addresses to use its domain names when sending out emails, but also provides a way that a receiving email server can check that authorization.

Do I Need to Configure SPF?

You’ve probably been told that you need SPF (Sender Policy Framework) email authentication. But does a business really need it? And if so, are there any other benefits? That question is usually understood when the enterprise becomes a large e-mail exchanger for their organization. With SPF, you can track email behavior to detect fraudulent messages and protect your business from spam-related issues, spoofing and phishing attacks. SPF helps you achieve maximum deliverability and brand protection by verifying the identity of the senders.

How Does SPF Function?

  • SPF records are specially formatted Domain Name System (DNS) records published by domain administrators that define which mail servers are authorized to send mail on behalf of that domain.
  • With SPF configured for your domain, whenever an email is sent from your domain the recipient’s mail server looks up the specifications for the return-path domain in the
  • DNS. It subsequently tried to match the IP address of the sender to the authorized addresses defined in your SPF record.
  • According to the SPF policy specifications the receiving server then decides whether to deliver, reject or flag the email in case it fails authentication.

Breaking Down the Syntax of an SPF Record

Let’ take the example of an SPF record for a dummy domain with the correct syntax:

v=spf1  ip4:29.337.148 include:domain.com -all

 

Stopping the “No SPF Record Found” Message

If you want to stop getting the annoying “No SPF record found” prompt all you need to do is configure SPF for your domain by publishing a DNS TXT record. You can use our free SPF record generator to create an instant record with the correct syntax, to publish in your DNS.

All you need to do is:

  • Choose if you want to allow servers listed as MX to send emails for your domain
  • Choose if you want to allow current IP address of the domain to send email for this domain
  • Fill in the IP addresses authorized to send emails from your domain
  • Add any other server hostnames or domains that may deliver or relay mail for your domain
  • Choose your SPF policy mode or the level of strictness of the receiving server from Fail (non-compliant emails will be rejected), Soft-fail (Non-compliant emails will be accepted but marked), and Neutral (Mails will probably be accepted)
  • Click on Generate SPF Record to instantly create your record

In case you already have SPF configured for your domain, you can also use our free SPF record checker to lookup and validate your SPF record and detect issues.

Is Publishing an SPF Record Enough?

The answer is no. SPF alone cannot prevent your brand from being impersonated. For optimal protection against direct-domain spoofing, phishing attacks, and BEC, you need to configure DKIM and DMARC for your domain.

Furthermore, SPF has a limit of 10 DNS lookups. If you exceed this limit your SPF will break and authentication will fail for even legitimate emails. This is why you need a dynamic SPF flattener that will help your stay under the 10 DNS lookup limit, as well as keep you updated on changes made by your email exchange providers.

Hopefully this blog helped you resolve your problem and you never have to worry about the “No SPF record found” message bothering you again. Sign up for a free email authentication trial to improve your email deliverability and email security today!

 

/by

Reasons to avoid SPF Flattening

Reasons why to avoid SPF Flattening

Sender Policy Framework, or SPF is a widely acclaimed email authentication protocol that validates your messages by authenticating them against all the authorized IP addresses registered for your domain in your SPF record. In order to validate emails, SPF specifies to the receiving mail server to perform DNS queries to check for authorized IPs, resulting in DNS lookups.

Your SPF record exists as a DNS TXT record that is formed of an assemblage of various mechanisms. Most of these mechanisms (such as include, a, mx, redirect, exists, ptr) generate DNS lookups. However, the maximum number of DNS lookups for SPF authentication is limited to 10. If you are using various third-party vendors to send emails using your domain, you can easily exceed the SPF hard limit.

You might be wondering, what happens if you exceed this limit? Exceeding the 10 DNS lookup limit will lead to SPF failure and invalidate even legitimate messages sent from your domain. In such cases the receiving mail server returns an SPF PermError report to your domain if you have DMARC monitoring enabled.This makes us come to the primary topic of discussion for this blog: SPF flattening.

What is SPF Flattening?

SPF record flattening is one of the popular methods used by industry experts to optimize your SPF record and avoid exceeding the SPF hard limit. The procedure for SPF flattening is quite simple. Flattening your SPF record is the process of replacing all include mechanisms with their respective IP addresses to eliminate the need for performing DNS lookups.

For example, if your SPF record initially looked something like this:

v=spf1 include:spf.domain.com -all

A flattened SPF record will look something like this:

v=spf1 ip4:168.191.1.1 ip6:3a02:8c7:aaca:645::1 -all

This flattened record generates only one DNS lookup, instead of performing multiple lookups. Reducing the number of DNS queries performed by the receiving server during email authentication does help in staying under the 10 DNS lookup limit, however, it has problems of its own.

The Problem with SPF Flattening

Apart from the fact that your manually flattened SPF record may get too lengthy to publish on your domain’s DNS (exceeding the 255 character limit), you have to take into account that your email service provider may change or add to their IP addresses without notifying you as the user. Every now and then when your provider makes changes to their infrastructure, these alterations would not be reflected in your SPF record. Hence, whenever these changed or new IP addresses are used by your mail server, the email fails SPF on the receiver’s side.

PowerSPF: Your Dynamic SPF Record Generator

The ultimate goal of PowerDMARC was to come up with a solution that can prevent domain owners from hitting the 10 DNS lookup limit, as well as optimize your SPF record to always stay updated on the latest IP addresses your email service providers are using. PowerSPF is your automated SPF flattening solution that pulls through your SPF record to generate a single include statement. PowerSPF helps you:

  • Add or remove IPs and mechanisms with ease
  • Auto update netblocks to make sure your authorized IPs are always up-to-date
  • Stay under the 10 DNS lookup limit with ease
  • Get an optimized SPF record with a single click
  • Permanently defeat ‘permerror’
  • Implement error free SPF

Sign up with PowerDMARC today to ensure enhanced email deliverability and authentication, all while staying under the 10 DNS SPF lookup limit.

/by

How to Optimize SPF Record?

In this article, we will explore how to optimize SPF record easily for your domain. For enterprises as well as small businesses who are in possession of an email domain for sending and receiving messages among their clients, partners and employees, it is highly probable that an SPF record exists by default, which has been set up by your inbox service provider. No matter if you have a pre-existent SPF record or you need to create a new one, you need to optimize your SPF record correctly for your domain in order to ensure that it causes no email delivery issues.

Some email recipients strictly require SPF, which indicates that if you do not have an SPF record published for your domain your emails may be marked as spam in your receiver’s inbox. Moreover, SPF helps in detecting unauthorized sources sending emails on behalf of your domain.

Let us first understand what is SPF and why do you need it?

Sender Policy Framework (SPF)

SPF is essentially a standard email authentication protocol that specifies the IP addresses that are authorized to send emails from your domain. It operates by comparing sender addresses against the list of authorized sending hosts and IP addresses for a specific domain that is published in the DNS for that domain.

SPF, along with DMARC (Domain-based Message Authentication, Reporting and Conformance) is designed to detect forged sender addresses during email delivery and prevent spoofing attacks, phishing, and email scams.

It is important to know that although the default SPF integrated into your domain by your hosting provider ensures that emails sent from your domain are authenticated against SPF if you have multiple third-party vendors to send emails from your domain, this pre-existent SPF record needs to be tailored and modified to suit your requirements. How can you do that? Let’s explore two of the most common ways:

  • Creating a brand new SPF record
  • Optimizing an existing SPF record

Instructions on How to Optimize SPF Record

Create a Brand New SPF Record

Creating an SPF record is simply publishing a TXT record in your domain’s DNS to configure SPF for your domain. This is a mandatory step that comes before you start on how to optimize SPF record. If you are just starting out with authentication and unsure about the syntax, you can use our free online SPF record generator to create an SPF record for your domain.

An SPF record entry with a correct syntax will look something like this:

v=spf1  ip4:38.146.237 include:example.com -all

v=spf1Specifies the version of SPF being used
ip4/ip6This mechanism specifies the valid IP addresses that are authorized to send emails from your domain.
includeThis mechanism tells the receiving servers to include the values for the SPF record of the specified domain.
-allThis mechanism specifies that emails that are not SPF compliant would be rejected. This is the recommended tag you can use while publishing your SPF record. However it can be replaced with ~ for SPF Soft Fail (non-compliant emails would be marked as soft fail but would still be accepted) Or + which specifies that any and every server would be allowed to send emails on behalf of your domain, which is strongly discouraged.

If you already have SPF configured for your domain, you can also use our free SPF record checker to lookup and validate your SPF record and detect issues.

Common Challenges and Errors while Configuring SPF

1) 10 DNS Lookup limit 

The most common challenge faced by domain owners while configuring and adopting SPF authentication protocol for their domain, is that SPF comes with a limit on the number of DNS lookups, which cannot exceed 10. For domains relying on multiple third-party vendors, the 10 DNS lookup limit exceeds easily which in turn breaks SPF and returns an SPF PermError. The receiving server in such cases automatically invalidates your SPF record and blocks it.

Mechanisms that initiate DNS lookups: MX, A, INCLUDE, REDIRECT modifier

2) SPF Void Lookup 

Void lookups refer to DNS lookups which either return NOERROR response or NXDOMAIN response (void answer). While implementing SPF it is recommended to ensure DNS lookups do not return a void answer in the first place.

3) SPF Recursive loop

This error indicates that the SPF record for your specified domain contains recursive issues with one or more of the INCLUDE mechanisms. This takes place when one of the domains specified in the INCLUDE tag contains a domain whose SPF record contains the INCLUDE tag of the original domain. This leads to a never-ending loop causing email servers to continuously perform DNS lookups for the SPF records. This ultimately leads to exceeding the 10 DNS lookup limit, resulting in emails failing SPF.

4) Syntax Errors 

An SPF record may exist in your domain’s DNS, but it is of no use if it contains syntax errors. If your SPF TXT record contains unnecessary white spaces while typing the domain name or mechanism name, the string preceding the extra space would be completely ignored by the receiving server while performing a lookup, thereby invalidating the SPF record.

5) Multiple SPF records for the same domain

A single domain can have only one SPF TXT entry in the DNS. If your domain contains more than one SPF record, the receiving server invalidates all of them, causing emails to fail SPF.

6) Length of the SPF record 

The maximum length of a SPF record in the DNS is limited to 255 characters. However, this limit can be exceeded and a TXT record for SPF can contain multiple strings concatenated together, but not beyond a limit of 512 characters, to fit the DNS query response (according to RFC 4408). Though this was later revised, recipients relying on older DNS versions would not be able to validate emails sent from domains containing a lengthy SPF record.

Optimizing your SPF Record

In order to promptly modify your SPF record you can use the following SPF best practices:

  • Try typing down your email sources in decreasing order of importance from left to right in your SPF record
  • Remove obsolete email sources from your DNS
  • Use IP4/IP6 mechanisms instead of A and MX
  • Keep your number of INCLUDE mechanisms as low as possible and avoid nested includes
  • Do not publish more than one SPF record for the same domain in your DNS
  • Make sure your SPF record doesn’t contain any redundant white spaces or syntax errors

Note: SPF flattening is not recommended since it isn’t a one-time deal. If your email service provider changes their infrastructure, you’re going to have to change your SPF records accordingly, every single time.

Optimizing Your SPF Record Made Easy with PowerSPF

You can go ahead and try implementing all those above-mentioned modifications to optimize your SPF record manually, or you can forget the hassle and rely on our dynamic PowerSPF to do all that for you automatically! PowerSPF helps you optimize your SPF record with a single click, wherein you can:

  • Add or remove sending sources with ease
  • Update records easily without having to manually make changes to your DNS
  • Get an optimized auto SPF record with the single click of a button
  • Stay under the 10 DNS lookup limit at all time
  • Successfully mitigate PermError
  • Forget about SPF record syntax errors and configuration issues
  • We take away the burden of resolving SPF limitations on your behalf

Sign up with PowerDMARC today to bid adieu to SPF limitations forever!  

/by

Why SPF Isn’t Good Enough to Stop Spoofing

As a DMARC services provider, we get asked this question a lot: “If DMARC just uses SPF and DKIM authentication, why should we bother with DMARC? Isn’t that just unnecessary?”

On the surface it might seem to make little difference, but the reality is very different. DMARC isn’t just a combination of SPF and DKIM technologies, it’s an entirely new protocol by itself. It has several features that make it one of the most advanced email authentication standards in the world, and an absolute necessity for businesses.

But wait a minute. We’ve not answered exactly why you need DMARC. What does it offer that SPF and DKIM don’t? Well, that’s a rather long answer; too long for just one blog post. So let’s split it up and talk about SPF first. In case you’re not familiar with it, here’s a quick intro.

What is SPF?

SPF, or Sender Policy Framework, is an email authentication protocol that protects the email receiver from spoofed emails. It’s essentially a list of all IP addresses authorized to send email through your (the domain owner) channels. When the receiving server sees a message from your domain, it checks your SPF record that’s published on your DNS. If the sender’s IP is in this ‘list’, the email gets delivered. If not, the server rejects the email.

Read more

As you can see, SPF does a pretty good job keeping out a lot of unsavoury emails that could harm your device or compromise your organisation’s security systems. But SPF isn’t nearly as good as some people might think. That’s because it has some very major drawbacks. Let’s talk about some of these problems.

Limitations of SPF

SPF records don’t apply to the From address

Emails have multiple addresses to identify their sender: the From address that you normally see, and the Return Path address that’s hidden and require one or two clicks to view. With SPF enabled, the receiving email server looks at the Return Path and checks the SPF records of the domain from that address.

The problem here is that attackers can exploit this by using a fake domain in their Return Path address and a legitimate (or legitimate-looking) email address in the From section. Even if the receiver were to check the sender’s email ID, they’d see the From address first, and typically don’t bother to check the Return Path. In fact, most people aren’t even aware there is such a thing as Return Path address.

SPF can be quite easily circumvented by using this simple trick, and it leaves even domains secured with SPF largely vulnerable.

SPF records have a DNS lookup limit

SPF records contain a list of all the IP addresses authorized by the domain owner to send emails. However, they have a crucial drawback. The receiving server needs to check the record to see if the sender is authorized, and to reduce the load on the server, SPF records have a limit of 10 DNS lookups.

This means that if your organization uses multiple third party vendors who send emails through your domain, the SPF record can end up overshooting that limit. Unless properly optimized (which isn’t easy to do yourself), SPF records will have a very restrictive limit. When you exceed this limit, the SPF implementation is considered invalid and your email fails SPF. This could potentially harm your email delivery rates.

Learn more

 

SPF doesn’t always work when the email is forwarded

SPF has another critical failure point that can harm your email deliverability. When you’ve implemented SPF on your domain and someone forwards your email, the forwarded email can get rejected due to your SPF policy.

That’s because the forwarded message has changed the email’s recipient, but the email sender’s address stays the same. This becomes a problem because the message contains the original sender’s From address but the receiving server is seeing a different IP. The IP address of the forwarding email server isn’t included within the SPF record of original sender’s domain. This could result in the email being rejected by the receiving server.

How does DMARC solve these issues?

DMARC uses a combination of SPF and DKIM to authenticate email. An email needs to pass either SPF or DKIM to pass DMARC and be delivered successfully. And it also adds one key feature that makes it far more effective than SPF or DKIM alone: Reporting.

With DMARC reporting, you get daily feedback on the status of your email channels. This includes information about your DMARC alignment, data on emails that failed authentication, and details about potential spoofing attempts.

If you’re wondering about what you can do to not get spoofed, check out our handy guide on the top 5 ways to avoid email spoofing.

/by