Information Systems:Implementing SPF, DMARC, and DKIM
Overview
SPF, DMARC, and DKIM are three email technologies that help protect a domain against phishing and spoofing. Because these technologies involve public DNS records, having these implemented can positively influence the company's "internet" reputation. Conversely, not having any of these implemented could suggest weaknesses in that company's technical department and infrastructure. For example, in 2021, an external audit of our network conducted as a part of a pre-assessment for a company insurance policy stated that SPF and DMARC were required to be implemented before the insurance firm would be able to provide a quote. Prior to the migration to Exchange, neither of these 3 technologies were implemented, so these are new to uniPHARM as of May 2021 but classifies as one of those things that should have been done a long time ago.-norwizzle (talk)
This article describes the implementation of SPF, DMARC and DKIM for our domains, with the goal of properly implementing all 3 of these features. Explanation of the underlying concepts is left to online research at the interested-user's discretion.
SPF
SPF records are in place for the 2 domains. This is the one for unipharm.com as of May 2021 (check actual record for any changes since):
v=spf1 a:mail.unipharm.com ip4:207.102.139.99/32 include:spf.protection.outlook.com include:spf.exwaresolutions.com ~all
Explained:
- Permitted sender: our on-prem mail server (MDaemon) via an A record and its IPv4 address.
- Permitted sender: Microsoft Exchange servers through external SPF record inclusion
- Permitted sender: Exware servers through external SPF record inclusion
- Policy: Soft-fail, meaning we indicate that senders not in this permitted list are likely spoofing the domain, but do not reject or quarantine them. This should be changed soon...
DMARC
DMARC records are in place for the 2 domains and are set to report-only mode. The email account dmarc@unipharm.com, along with the alias dmarc@medicinecentre.com, were created in MDaemon to receive DMARC aggregate reports. We are already receiving reports from major email providers like Yahoo and Gmail. Microsoft appears to have its own DMARC processing internally, which is viewable in Security Admin Center. DMARC reports are in XML format and are not meant to consumed raw, but rather machine-parsed and summarized. Online analysis tools are paid and not feasible currently. Therefore, as a fun mini-project, I'm creating a mini-system to process and view the data of these reports. This involves importing these attachments from email, writing them to a DB, and displaying the data in InfoNext. Details to come. -norwizzle (talk)
DKIM
TBD/TBC. DKIM is the next step in this process of implementing email security. It is a little more difficult to implement, and the risks from improper implementation are greater.