Menu
By Cian Fitzpatrick | 17th May 2024
Not the cool kid in town, and as old as the internet itself, email remains the most productive business tool. By the same token, it’s the most effective tool for cybercriminals. With this in mind, regulators have been focusing on email security in an attempt to curtail cybercrime.
As methods became more sophisticated than simply poorly worded emails promising royal riches from secret vaults in places unknown, so too have security protocols and technology to halt the incoming onslaught. Proactive security solutions are the only way to protect organisations in this age where data is gold.
Domain-based Message Authentication, Reporting, and Conformance, also known as DMARC, is a solution developed to be highly effective in email security. So much so that Google and Yahoo have implemented stringent DMARC regulations taking effect in February of this year for senders of 5000 or more messages per day.
Email domains must have a DMARC policy in the DNS (Domain Name System) and messages must pass DMARC alignment, or they won’t be delivered to Yahoo and Gmail inboxes. This applies to messages sent on an organisation’s behalf through email service providers such as MailChimp.
The DNS is the equivalent of the internet’s phonebook – remember those? We access websites through a name, but web browsers talk to each other through IP addresses, so the DNS essentially converts domain names to IP addresses.
DMARC integrates SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to verify an email’s authenticity.
One of the biggest issues in recent security breaches has been that attackers can impersonate a domain, making an email look like it comes from someone, when it really comes from someone else (a fraudster).
DMARC is a robust solution that makes sure to check that the email originates where it says it originates, and can then block phishing and impersonation attempts.
DMARC relies on two key elements:
DMARC records instruct recipient servers on handling emails that fail authentication checks, either by quarantine or outright rejection. This may be flagged due to a difference between a supposed email sender and the actual email address. It’s a crucial layer of defence.
In the old days, platforms like Google relied on filters to sieve out spammers and fraudsters. The filters were often so severe that legitimate emails would be blocked. Cyber security is always a fine line between keeping a system safe and minimising user discomfort.
Google and Yahoo’s move to compel businesses to adopt DMARC is encouraging. On one hand, organisations are teaching their employees to have a healthy distrust of email. However, as a brand and organisation, you want those with whom you engage to trust your digital communications. By implementing solid security measures like those offered by Topsec Cloud Solutions, it’s an opportunity to strategically raise your brand profile as one that can be trusted.
The DMARC initiative by Google and Yahoo isn’t purely about technology.
The three pillars behind this strategy from a user’s perspective are that email will be authenticated in the background (as discussed above), it will be easy to unsubscribe from mailing lists, and emails cannot be spammy – they have to be wanted by recipients.
This is a positive move for users and organisations, although it does mean that businesses may have to review their technology strategy if they send more than 5000 emails a day. The idea is to encourage and enhance trust in email communications and to proactively protect against fraud.
For organisations that have yet to implement DMARC, it’s an opportunity to ensure the protocol is correctly executed, but it’s also as a confidence-building practice within and across organisations.
There’s an element of brand reputation and integrity in all of this. Who doesn’t want to do business with an ethical organisation that looks after its assets and its clients’ assets? For marketing teams, it’s a chance to demonstrate outstanding values and a security-aware ethos.
This is not just a technology issue. Once again, it’s highlighted that cybersecurity belongs to each stakeholder in the business.
There’s also the compliance angle. Failure to comply will lead to delays in email delivery and possible rejection. The effect on brand reputation and trust in integrity will be significant.
And that’s the best-case scenario.
The possibility of a cyber attack becomes very real for organisations that don’t comply, or which implement DMARC incorrectly. These attacks have devastating financial and reputational consequences. It’s the responsibility of each organisation to secure their digital channels.
Recovering from a phishing or spoofing attack is expensive, time-consuming, and incredibly stressful for stakeholders. Data and privacy breaches become a nightmare for everyone and the damage can be permanent, or at best, lengthy to repair.
Both Google and Yahoo offer transparent error codes for each email rejection. The error codes are freely available and offer an explanation along with the numerical code, making it easy to understand why an email was blocked, and what action should be taken. Failures are generally either temporary or permanent.
With 90% of all cyber attacks initiated through phishing, which is generally done via email, it’s understandable that the largest tech organisations are taking control. By forcing companies to protect themselves and their users, they’re helping to make the internet a safer place and combat cybercrime. This is and always will be a process, but organisations need to work together. And this is more than a security issue, it’s a chance to prove to clients that your organisation is taking security seriously.
Our DMARC Protection product is a robust email security solution against hackers misusing your domain. Click here for your downloadable guide on the key features and benefits of DMARC Protection for your organisation. Then contact us. We’d be delighted to help you fortify your email security and keep your business safe from cyber-attacks with our combination of technology power and human expertise.
Deep dive into some of the online risks and how you can protect yourself from these risks.