Cyberstudy
PDF p.286 In progress

Email Security

Open PDF at p.286 6 flashcards

Summary

PDF p.286

Three key technologies—Sender Policy Framework (SPF), Domain Keys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting & Conformance (DMARC)—are essential for verifying email authenticity and preventing phishing and spam. These technologies, along with email gateways and Secure/Multipurpose Internet Mail Extensions (S/MIME), significantly enhance email security.

In plain words

Supplementary — not from your PDF

SPF, DKIM and DMARC together make domain spoofing hard. SPF publishes in DNS which IP addresses may send for a domain. DKIM signs messages so receivers can check the signature with a public key in DNS. DMARC tells receivers what to do when SPF or DKIM fail (none, quarantine or reject) and sends reports. Email gateways filter spam and malware and apply these checks. S/MIME uses certificates to encrypt and sign individual messages.

Detailed explanation

PDF p.286

SPF (Sender Policy Framework)

  • Function: Detects and prevents sender address forgery in phishing and spam emails.
  • Mechanism: Verifies the sender's IP address against authorized IP addresses listed in the DNS TXT records of the sender's domain.
  • Process: Receiving mail server checks the SPF record to confirm the email originated from an authorized system.

DKIM (DomainKeys Identified Mail)

  • Function: Uses encryption to enable email verification.
  • Mechanism: Sender signs emails with a digital signature.
  • Process: Receiving server uses a DKIM record in the sender's DNS to verify the signature and email integrity.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

  • Function: Defines rules for handling messages based on SPF and DKIM checks.
  • Mechanism: Provides reporting capabilities for domain owners to monitor email activity.
  • Process: Can move messages to quarantine, reject them, or tag them based on authentication results.

Combined Use of SPF, DKIM, and DMARC

  • Enhancement: Makes it difficult for attackers to impersonate trusted domains.
  • Importance: Essential for verifying email authenticity, maintaining content integrity, and ensuring safe delivery.

Email Gateway

  • Function: Controls all incoming and outgoing email traffic.
  • Mechanism: Uses anti-spam filters, antivirus scanners, and threat detection algorithms.
  • Process: Scrutinizes emails to remove threats, enforces policies, and automates authentication using DMARC, SPF, and DKIM.

S/MIME (Secure/Multipurpose Internet Mail Extensions)

  • Function: Secures email communications.
  • Mechanism: Uses public key encryption and digital signatures.
  • Process: Encrypts email content and verifies sender authenticity to ensure confidentiality and integrity.

Important terms

taken from the text above
Enhancement
Makes it difficult for attackers to impersonate trusted domains.
SPF Sender Policy Framework DKIM Domain Keys Identified Mail S/MIME Secure/Multipurpose Internet Mail Extensions

Examples & real-world scenarios

Supplementary — not from your PDF
  • An SPF TXT record listing a company's mail servers.
  • A DMARC policy set to quarantine failures.
  • Signing a sensitive email with S/MIME.

Scenario

Attackers send invoices that appear to come from a company's domain. Publishing SPF and DKIM and a DMARC reject policy makes receiving servers discard the forged mail.

Common mistakes

Supplementary — not from your PDF
  • Mixing up SPF (authorized sending IPs), DKIM (signature) and DMARC (policy and reporting).
  • Setting up DMARC with policy 'none' and never tightening it.

Practical skills

Supplementary — not from your PDF
  • Explain what each of SPF, DKIM and DMARC checks.
  • Look up your own domain's SPF and DMARC records.

What I should remember

Key Points PDF p.286
  • SPF
    • Function: Prevents sender address forgery.
    • Mechanism: Verifies sender's IP against DNS TXT records.
  • DKIM
    • Function: Enables email verification.
    • Mechanism: Uses digital signatures.
  • DMARC
    • Function: Defines handling rules based on SPF and DKIM.
    • Mechanism: Provides reporting and monitoring.
  • Combined Use
    • Enhancement: Prevents domain impersonation.
    • Importance: Verifies authenticity and integrity.
  • Email Gateway
    • Function: Controls email traffic.
    • Mechanism: Uses filters and threat detection.
    • Process: Enforces policies and automates authentication.
  • S/MIME
    • Function: Secures email communications.
    • Mechanism: Uses encryption and digital signatures.
    • Process: Ensures confidentiality and integrity.