Cyberstudy
Supplementary — not from your PDF Beginner ~20 min

Read email security DNS records

Look up the MX, SPF and DMARC records for domains you use, and explain what each one tells receiving mail servers.

Environment

PowerShell (Resolve-DnsName) or a terminal (nslookup / dig).

Before you start

  • Read Email Services (p.284), Email Security (p.286) and DNS Filtering (p.289).

You will

  • Find MX, SPF and DMARC records
  • Interpret SPF mechanisms and DMARC policy

Steps

  1. 1

    Pick your email provider's domain, or your own domain if you have one.

  2. 2

    MX records: Resolve-DnsName example.com -Type MX (or nslookup -type=mx example.com).

  3. 3

    SPF: Resolve-DnsName example.com -Type TXT and find the string starting v=spf1. Note its include: entries and whether it ends in -all or ~all.

  4. 4

    DMARC: Resolve-DnsName _dmarc.example.com -Type TXT. Note p=none, quarantine or reject, and the rua= reporting address.

  5. 5

    Compare two domains. Which one has the stricter policy?

  6. 6

    Connect it to the phishing lab: which of these records produced the spf= and dmarc= results you saw in the message headers?

Check your understanding

  • ?What's the difference between SPF -all and ~all?
  • ?What does a DMARC policy of p=reject tell receivers to do?
  • ?Why does DKIM need a public key published in DNS?