July 15

Webinar takeaway: Implement DMARC the Right Way to Keep Phishing Attacks Out of Your Inbox

Email, Security

0  comments

My key takeaways

  • DMARC uses SPF and/or DKIM
  • In 2021 the National Defense Authorization Act says the Department of Homeland Security (DHS) must implement DMARC US wide
  • there exists an RFC for "email from"
  • SPF = receiving email server checks MAIL FROM address or the domain’s IP address in the HELO handshake against the sender’s SPF DNS record
  • -all = hard fail, ~all = soft fail, +all = no fails
  • M$ protects O365 inboxes with "Additional Spoof Intelligence™"
  • Disable outdated SenderID by creating a TXT-record with spf2.0/pra ?all
  • enabled in Microsoft Exchange (2010/2013/2016) on premise with & $env:ExchangeInstallPath\Scripts\Install-AntiSpamAgents.ps1 and Set-SenderIDConfig -ExternalMailEnabled $false
  • you would not be able to use DKIM if your mailserver does not support it
    • eg on shared hosting mail servers
    • but also Exchange on-premise
  • Phishers create typo squatted domains and configure SPF, DKIM and DMARC perfectly, so this way the email wont be rejected
    • they use the weapons developed to stop them
  • SPF, DKIM, and DMARC is widely misconfigured, most commonly:
    • Missing records
    • Old, not updated key pairs
    • Bad IP addresses
    • Missed domains
  • Phishers use freemailers like hotmail and gmail, so SPF, DKIM and DMARC wont stop them
    • SPF, DKIM and DMARC is domain based, not email based

Env

additional links

Tags

deliverability, dkim, dmarc, email marketing, phishing, spf

You may also like

Ethical considerations in phishing tests: to inform employees or not?

TL;DR This article delves into the ethical considerations in phishing tests, highlighting the balance needed between conducting realistic simulations and maintaining fairness in cybersecurity training. This article explores the complexities of conducting phishing simulations in the workplace. Key takeaways include the importance of transparency in fostering a positive security culture, building trust through clear communication,

Read More

Webinar Takeaway: Roger Grimes Teaches You Phishing Mitigation

My key takeaways ~40 threats/day in 2020 to take care of top 3 initial breach root causes social engineering unpatched software (>90% Java) medium threat general mitigations policies tech. defenses security awareness training Also educate your vendors about your AUP include a phishing mitigation section in your AUP paying everybody $1000/year who doesn’t fall for

Read More
Leave a Comment