As more employees work remotely, the more an organization’s vital infrastructure is at risk for cyber crime.
Domain-based Message Authentication Reporting and Conformance (DMARC) is a free and open technical specification that is used to authenticate email and provide domain users with oversight and control on how their email domains are being used.
A DMARC record is a text entry within the DNS record that tells the world your email domain’s policy after checking SPF and DKIM status. DMARC authenticates if either SPF, DKIM, or both pass, and tells the world what to do with the email that doesn’t authenticate. It also tells email servers to send XML reports back to a reporting email address. These reports provide insight on how your email is moving through the ecosystem and allows you to identify everything that is using your email domain.
By having DMARC in place, domain owners large and small can fight business email phishing and spoofing by deciding who can send email on behalf of their domain and denying the rest.
Protection and visibility
DMARC can provide your organization protection from spear phishing exploits such as Business Email Compromise (BEC), a specific type of attack that uses email spoofing to deceive organizations in order to achieve a specific goal like extracting user credentials or financial details/transfers.
Not only can DMARC protect you, it can protect the people you do business with from Vendor Email Compromise—a specific type of BEC scam that targets vendors or suppliers via phishing emails and then sends fake invoices to customers. Increasingly, DMARC is becoming a requirement for contractors doing business with government agencies around the globe. Two examples are BOD 18-01 (from the Department of Homeland Security) and SIMM 5315-A (from the State of California).
In addition to protection from spoofing, DMARC gives organizations visibility over their email domain—the ability to identify and audit all usage by third party platform providers. “Shadow IT” is the use of IT-related hardware or software products within an organization without the knowledge of the internal IT or security group. It has grown exponentially in recent years, driven by the quality of consumer applications in the cloud such as file sharing apps, social media and collaboration tools. These unknown or unauthorized uses of an organization’s domains are opportunities that can be exploited by malicious actors.
Expert advantage to protect against phishing
Founded in 2012 by a primary author of the DMARC specification, dmarcian is dedicated to upgrading the entire world’s email by making DMARC accessible to all via education and advocacy, along with the following:
- SaaS Platform: We turn the data generated by your email as it moves through the Internet into a data-rich display and alert you if there are any potential threats or abuse on your domains.
- Deployment Services: We have developed a successful, efficient project-based approach that helps with deployment and addresses how it affects the different aspects of your organization.
- Dedicated Support: Although deploying DMARC can be viewed as a one-time technology upgrade, managing and maintaining DMARC compliance needs long-term effort to remain effective.
When it comes to protection against phishing, DMARC is the foundation to protect and control your email domains and should be a part of a layered, comprehensive approach to phishing protection.
Extend that protection with Inspired eLearning’s user awareness training which creates well-trained end users educated and aware of phishing threats. Coupled with GreatHorn’s advanced threat protection, our partners can provide layered defense against cyberattacks across your largest attack vector—your email.
