What is DMARC and how can it improve your email security?

The threat landscape is constantly evolving, with hackers finding new and ingenious ways to attack businesses. One constant, however, is the prevalence of email as an attack vector, ever since its rise in popularity in the 1990s.

The wide usage of email has made it a ripe target for hackers, and today, 95% of all hacking attacks and data breaches involve email. Domain spoofing, in which an attacker pretends to send an email from a legitimate domain, is a tactic often used in phishing - which accounts for 80% of cyber attacks.

With email a vital form of communication not only between and within organisations, but with consumers in our digital age, we explain how you can defend your organisation against domain spoofing and the benefits you'll see from doing so.

What is DMARC?

DMARC – which stands for domain-based message authentication, reporting, and conformance – is an email authentication protocol that helps protect against spoofing activity.

Through DMARC, domain owners can monitor what emails are sent using their domain and receivers have a clear way of reporting illegitimate emails.

The domain owners confirm their messages are protected by two existing authentication techniques, SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail). On the receiving end, emails that don't use SPF and DKIM are rejected or put in the junk or spam folders.

An organisation's DMARC record is published alongside its DNS records. These records help the organisation see who is sending emails through their domain and make it easier for internet service providers to perform a DMARC check and stop malicious messages.

Growth of DMARC

The DMARC guidelines were first published by PayPal, Google, Microsoft, and Yahoo! In 2012.

Security experts in the financial industry were the first to adopt DMARC more widely, and since then it has grown in popularity. A report from Valimail showed that the number of domains using DMARC rose from 125,000 in January 2017 to almost a million in January 2020.

Currently, the protocol is awaiting approval by the Internet Engineering Task Force to become an open standard in the US, and is included in the UK government's official guidance for secure email setup.

Pros and cons of DMARC

DMARC is a powerful tool that improves the deliverability of a business' emails. Without it, your domain is 4.75 times more likely to be a spoofing target.

SPF and DKIM are more siloed methods of domain authentication, which DMARC is meant to address, combining the use of these methods and adding a reporting function.

DMARC is beneficial at a small scale, improving your reputation and increasing your visibility into your email programme, but it also benefits the wider email community by setting a consistent standard that increases the overall trustworthiness of email communications.

However, DMARC is slightly limited in what it can do. It only protects against direct domain spoofing, in which someone is saying they are sending from a legitimate domain, rather than 'cousin' domain attacks that originate from domains that are, say, only one letter off from a legitimate domain.

In addition, DMARC only really offers protection against impersonation when it's combined with an enforcement policy. When purely used for visibility, it gives an organisation great insights but doesn't do anything to stop impersonators. Through enforcement, you can set policies to deal with unauthorised emails that stop them before they are even sent out.

With three billion messages per day still including a spoof of the sender's identity, DMARC is by no means a conclusive solution to email attacks, but it is still an important tool that all organisations can easily enact to protect themselves, their customers and partners, and their reputation as a trustworthy, safe business.