Email Authentication Methods and Best Practices

Email authentication is a crucial aspect of email security, and it's essential to understand the various methods and best practices involved. SPF (Sender Policy Framework) is a widely adopted authentication method that verifies the sender's IP address against a published list of authorized IP addresses.

SPF can help prevent spam and phishing attacks by ensuring that emails come from a trusted source. The most common SPF record type is "include", which allows a domain to specify a list of authorized IP addresses.

Implementing SPF can be done by adding a TXT record to your domain's DNS settings, which can be a bit technical but is a crucial step in email authentication. Authenticating emails using SPF can help protect your email reputation and prevent spam.

DKIM (DomainKeys Identified Mail) is another authentication method that uses a digital signature to verify the sender's identity. This method is particularly useful for preventing email spoofing attacks.

A unique perspective: Domain Name System Blocklist

Email authentication is a crucial aspect of email security. In the early 1980s, Simple Mail Transfer Protocol (SMTP) was designed without real verification of sending user or system, making it vulnerable to spam, phishing, and other crimes.

The commercialization of the internet in the early 1990s led to a significant increase in these types of crimes, highlighting the need for email authentication. This is because email authentication is a necessary first step towards identifying the origin of messages, making policies and laws more enforceable.

Spoofing, where the intent is to deceive the recipient by masking the true source of the message, is a classic example of why email authentication is needed. In fact, a message has multiple sender values, including the MAIL FROM address and the From address, which can be different.

The MAIL FROM address is typically recorded in the Return-Path header field, while the From address is shown in email clients. However, these addresses can be spoofed, making it difficult to verify the true sender of a message.

Worth a look: Open Mail Relay

Email authentication can help automate email filtering at receiving servers, rejecting spoofed messages before they arrive in a user's Inbox. This can be achieved by using authentication tokens, such as those added by the sender's Administrative Management Domain (ADMD).

Here are some benefits of custom domain authentication:

By properly authenticating your domain, you can protect your brand's identity and prevent malicious activities.

Email authentication methods are a crucial aspect of protecting your brand's identity and preventing malicious spoofing. SPF, DKIM, and DMARC are the three primary email authentication methods.

SPF, or Sender Policy Framework, is a domain-based way to determine what IPs are allowed to send email on your behalf. It involves listing the specific IPs and sources authorized to send your mail, and when a message is sent using your domain in the Return-Path address, the receiver can look up the authorized sending sources for that domain to ensure the sending IP is listed there.

Readers also liked: Why Is My Email Sending Mass Spam Email

DKIM, or Domain Keys Identified Mail, is a message-based signature that uses cryptography to sign email and verify that your email was not altered in transit. It involves building encryption tokens for both the sent email and the receiving server, and uses several "keys" including a pair of keys for encryption itself, a public key living on your DNS, and a private key residing on your mail servers.

DMARC, or Domain-based Message Authentication, Reporting & Conformance, is a domain-based way to tell receivers how to handle authentication failures for your domain. It uses SPF and DKIM to check for alignment between domains in the MAIL FROM and From addresses, and specifies the action the destination email system should take on messages that fail DMARC.

Here are the three primary email authentication methods in a nutshell:

These methods can be built upon with newer, more nuanced technologies to multiply the security of your domains and brand. Without employing DKIM and SPF, you cannot add the benefits of DMARC.

Email authentication is a collection of activities created to confirm and verify the identity of an email sender. These techniques include Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting & Conformance (DMARC).

SPF uses a TXT record in DNS to identify valid email sources for your custom cloud domains. It allows the receiver to check that an email claimed to have come from a specific domain comes from an IP address authorized by that domain's administrators.

DKIM uses a domain to digitally sign important elements of the message and stores the signature in the message header. The destination server verifies that the signed elements of the message weren't altered in transit.

DMARC uses SPF and DKIM to check for alignment between domains in the MAIL FROM and From addresses. It also specifies the action the destination email system should take on messages that fail DMARC.

Recommended read: DomainKeys Identified Mail

Here's a brief overview of how each technique works:

Email authentication provides several benefits, including protecting both the brand and email recipients from spoofing and phishing. By confirming the sender is who they claim to be, email authentication is a key component of protecting both the brand and email recipients.

DMARC addresses the deficiencies of SPF and DKIM by using them to confirm that the domains in the MAIL FROM and From addresses match. It also specifies the action the destination email system should take on messages that fail DMARC.

Legitimate services that modify messages in transit before delivery break SPF, DKIM, and therefore DMARC checks. However, ARC can help by preserving the original email authentication information of modified messages.

A unique perspective: DMARC

To check your email authentication status, you can send an email from the domain you want to test and look for SPF, DKIM, and DMARC mentions in the message header. This will give you an idea of how your email authentication is performing.

You can also use a dedicated monitoring tool, like DMARC Digests, which can help identify email authentication issues that cause DMARC failures and provide actionable guidance to resolve problems.

To spot-check your email authentication, open an email in Gmail and look for the following:

Here's a breakdown of what to look for in the message header:

Remember, a triple pass would look like this: the message passes SPF, DKIM, and DMARC checks.

If your email is spoofed, email authentication can help you take action.

Email authentication can notify you if someone is using your company's email in a phishing scheme.

Spoofed emails can be a real problem, but having email authentication can help you stay on top of it.

If you get a notification that your email has been spoofed, take action right away.

Email authentication can help prevent phishing schemes by notifying you when someone is using your company's email.

You can take action by following the steps outlined in your email authentication system.

Microsoft 365 uses implicit email authentication to check inbound email due to phishing concerns and incomplete adoption of strong email authentication policies.

Implicit email authentication extends regular SPF, DKIM, and DMARC checks by using signals from other sources, such as sender reputation, sender history, recipient history, behavioral analysis, and other advanced techniques.

To avoid email authentication failures when sending mail to Microsoft 365, configure SPF, DKIM, and DMARC records for your domains. You can use the configuration information provided by your domain registrar or DNS hosting service.

If you host a domain's email or provide hosting infrastructure that can send email, email authentication ensures that Microsoft won't automatically junk email from your customer domains. However, delivery to Microsoft isn't guaranteed, even if you authenticate email originating from your platform.

For another approach, see: Sender Policy Framework

Avoiding Failures When Sending Mail to Microsoft 365 requires some configuration and understanding of email authentication.

Configure SPF, DKIM, and DMARC records for your domains using the information provided by your domain registrar or DNS hosting service. You can also use non-Microsoft services dedicated to helping set up these records.

Many companies don't publish SPF records because they don't know all the email sources for messages in their domain. This can lead to authentication failures.

If you host a domain's email or provide hosting infrastructure that can send email, delivery to Microsoft isn't guaranteed, even if you authenticate the email. However, email authentication ensures that Microsoft doesn't automatically junk email from your customer domains.

Here's a quick summary of the email authentication records you should configure:

Inbound email authentication for Microsoft 365 uses implicit email authentication, which goes beyond regular SPF, DKIM, and DMARC checks by incorporating signals from other sources to evaluate inbound email.

These sources include sender reputation, sender history, recipient history, behavioral analysis, and other advanced techniques. Microsoft 365 uses these signals to assess the authenticity of incoming emails.

Take a look at this: Sender Rewriting Scheme

Implicit email authentication helps mitigate phishing concerns by providing an additional layer of security. This is especially important since many email senders on the internet have not adopted strong email authentication policies.

Microsoft 365 checks inbound email for authentication using the following signals:

By using these signals, Microsoft 365 can better identify and block suspicious emails, protecting users from phishing and other types of email-based attacks.

If you're using a custom domain, you'll need to consider custom domain authentication. The following email authentication information assumes the use of a custom domain.

Custom domain authentication is a must if you're using a custom domain. This is because custom domains require specific settings to ensure email authentication works correctly.

You'll need to set up custom domain authentication if you want to use a custom domain. This will help you avoid any issues with email authentication.

Custom domain authentication involves setting up specific DNS records. This will allow your custom domain to work seamlessly with email authentication.

If you're not using a custom domain, you can skip custom domain authentication. But if you do decide to use a custom domain, make sure to set it up correctly to avoid any issues.

On a similar theme: Set up Two-factor Authentication for Email Gmail

In addition to the main authentication methods, there are a few other components worth mentioning. SPF, DKIM, and DMARC are the most commonly known and used email authentication methods.

Some of these lesser-known methods are either deprecated or haven't gained widespread support, but they still surface in discussions of email authentication. These standards can help determine their appropriateness for your program.

Here are a few examples of these other email authentication methods:

Note that BIMI (Brand Indicators for Message Identification) is not included in this list as it's a bonus method, not a lesser-known standard.

DNSWL is a way to look up a sender's reputation, possibly including their identification. This can be done by querying a DNSWL.

Looking up a DNSWL may provide an assessment of the sender, possibly including its identification.

DNSWL, or DNS-based whitelist, can provide an assessment of the sender, possibly including its identification.

Some proposed but less widely used email authentication methods have been deprecated or haven't gained much support. These include Sender ID and Certified Server Validation.

DomainKeys was another method that's no longer widely used, but it's still worth knowing about.

A few other email authentication methods that are either deprecated or haven't gained widespread support include Sender ID, Certified Server Validation, and DomainKeys.

A fresh viewpoint: Bounce Address Tag Validation

DMARC is built on top of two existing mechanisms, SPF and DKIM, and allows the administrative owner of a domain to publish a policy in their DNS records to specify how to check the From: field presented to end users.

DMARC helps address the deficiencies of SPF and DKIM by using both to confirm that the domains in the MAIL FROM and From addresses match.

The DMARC policy specifies the action the destination email system should take on messages that fail DMARC, which can be to take no action, filter messages into a quarantine folder, or reject the mail altogether.

Here are the possible actions a DMARC policy can specify:

Security is a top priority when it comes to email authentication. DMARC (Domain-based Message Authentication, Reporting & Conformance) is a crucial component of a well-authenticated email program, detecting and preventing domain spoofing and phishing. It leverages both SPF and DKIM to direct mailbox providers what to do when both email authentication steps fail.

A fresh viewpoint: Who Should You Email When Emailing College Coaches

A DMARC policy in DNS specifies how receivers should process mail based on SPF and DKIM authentication results. For DMARC to pass, either SPF or DKIM must pass and align with the DMARC domain.

DMARC allows domain owners to publish a policy in their DNS records to specify how to check the From: field presented to end users. This policy can include recommendations on how to deal with failures and a reporting mechanism for actions performed under those policies.

To configure a DMARC policy, you can specify one of three actions: take no action (p=none), filter messages into a quarantine folder (p=quarantine), or do not accept the mail (p=reject).

Here are the DMARC policy actions:

By setting up a DMARC policy, you can ensure that your domain is protected from spoofing and phishing attempts.

ADSP allowed the specification of a policy for messages signed by the author's domain. A message had to go through DKIM authentication first, then ADSP could demand a punishing treatment if the message was not signed by the author domain(s) —as per the From: header field.

See what others are reading: Bounce Message

ADSP was demoted to historic in November 2013.

Author Domain Signing Practices (ADSP) is an extension to DKIM that authenticates emails. This allows relaying domains to publish the signing practices it uses on behalf of senders.

You should be familiar with how your ESP is handling your mail, as ADSP isn't much to worry about from the sender side of email.