M 3 AAWG DMARC Training Series. Mike Adkins, Paul Midgen DMARC.org October 22, 2012
|
|
|
- Everett Dennis
- 5 years ago
- Views:
Transcription
1 M 3 AAWG DMARC Training Series Mike Adkins, Paul Midgen DMARC.org October 22, 2012
2 M3AAWG DMARC Training Videos (2.5 hours of training) This is Segment 1 of 6 The complete series of DMARC training videos is available at: Segment 1 Segment 2 Segment 3 What is DMARC? DMARC Identifier Alignment DMARC Policy Records (about 20 minutes) (about 30 minutes) (about 20 minutes) Segment 4 DMARC Reporting (about 15 minutes) Segment 5 Segment 6 DMARC Information for Mailbox Providers DMARC Information for Domain Owners and 3rd Parties (about 20 minutes) (about 40 minutes)
3 What is DMARC? DMARC Segment 1 about 20 minutes Mike Adkins, Paul Midgen, DMARC.org October 22, 2012
4 Outline Part 1 Part 2 Introduction to DMARC Purpose and Goals History Roadmap DMARC Spec Overview Identifier Alignment DMARC Policy Records Reporting Information for Domain Owners The Reporting and Compliance Process Initial Record Publishing 3rd Party Deployment Profiles Report Processing and Analysis Initial Policy Ramp-up Ongoing Monitoring Short Break Information for Mailbox Providers DMARC Policy Enforcement Aggregate Reporting Forensic Reporting
5 Things we won t cover Why phishing is a problem. How DKIM, SPF, DNS, SMTP, or XML work. How to combat abuse of cousin domains or the display name field. Phishing website investigation or takedown services.
6 Who is in the audience? Mailbox providers? Domain owners? Domain owners who use 3rd party senders? 3rd party senders (ESPs, hosting providers, etc)?
7 Intro to DMARC DMARC = Domain-based Message Authentication, Reporting, and Conformance Authentication Leverage existing technology (DKIM and SPF) Reporting Gain visibility with aggregate and per-failure reports Conformance Standardize identifiers, provide flexible policy actions
8 Intro to DMARC Purpose and Goals Open version of existing private mechanisms for preventing domain spoofing. Standardize use of authenticated identifiers. Provide insight into and debugging aids for your authentication practices. Incent wider adoption of SPF & DKIM. Encourage iteration toward aggressive authentication policy.
9 Intro to DMARC Non-Goals Address cousin domain abuse Address display name abuse Provide MUA treatment advice An enterprise security solution An incident response tool Provide delivery reporting
10 Intro to DMARC - History Private Prototype between Paypal and Yahoo 2007 Vendors being offering similar functionality 2009 to present First Prototype DMARC records published - Feb '11 Draft specification released - Jan 30th 2012, revised April 12
11 Intro to DMARC - Roadmap Interop Event - July '12 Produce a final draft Submit to the IETF
12 This has been the first of six DMARC video segments View the entire M3AAWG DMARC Training Series from the public training video pages on the M3AAWG website at: Our thanks to Michael Adkins, Paul Midgen and DMARC.org for developing the material in this series and allowing M3AAWG to videotape it for professionals worldwide. This video is presented by the Messaging, Malware and Mobile Anti-Abuse Working Group slide PDF files and video copyrighted by the Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG
13 For information about M3AAWG: Contact us at:
14 M 3 AAWG DMARC Training Series Mike Adkins, Paul Midgen DMARC.org October 22, 2012 slide PDF files and videos copyrighted by the Messaging, Malware and Mobile Anti-Abuse Working Group (M 3 AAWG)
15 M3AAWG DMARC Training Videos (2.5 hours of training) This is Segment 2 of 6 The complete series of DMARC training videos is available at: Segment 1 Segment 2 Segment 3 What is DMARC? DMARC Identifier Alignment DMARC Policy Records (about 20 minutes) (about 30 minutes) (about 20 minutes) Segment 4 DMARC Reporting (about 15 minutes) Segment 5 Segment 6 DMARC Information for Mailbox Providers DMARC Information for Domain Owners and 3rd Parties (about 20 minutes) (about 40 minutes)
16 DMARC Identifier Alignment DMARC Segment 2 about 20 minutes Mike Adkins, DMARC.org and M 3 AAWG Co-Vice Chairman October 22, 2012
17 DMARC Spec Overview Aligned example.com DNS Server Unaligned DMARC record lookup Inbound MTAs X The Internet 2. DMARC Identifier Alignment X example.com Report Consumer 1. Check SPF & DKIM 3. Act on unaligned mail Forensic reports Aggregate reports Aggregate log data Aggregate Report Generator Mail Storage
18 DMARC Spec Identifier Alignment DMARC tests and enforces Identifier Alignment Authenticated Identifiers are checked against Mail User Agent (MUA) visible "RFC5322.From" domain Only one Authenticated Identifier has to Align for the to be considered in Alignment
19 DMARC Spec Identifier Alignment Identifier Alignment can be strict (match exactly) or relaxed: Relaxed SPF: The Organizational Domain of the SPF Authenticated RFC5321:Mail From and RFC5322:From must match. Relaxed DKIM: The Organizational domain from 'd=' value of DKIM authenticated signature and RFC5322.From must match.
20 DMARC Spec Identifier Alignment Organizational Domain TLD + 1 atom groups.facebook.com = facebook.com aol.co.uk = aol.co.uk foo.bar.example.ne.jp = example.ne.jp Uses publicsuffix.org for TLD list More robust methods being considered
21 DMARC Spec Alignment Examples SPF and DKIM Strict Identifier Alignment Authentication-Results: mx.mail.com; spf=pass (mail.com: domain of designates as permitted sender) dkim=pass DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=s q2; c=relaxed/simple; q=dns/txt; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" SPF domain = example.com DKIM domain = example.com From domain = example.com
22 DMARC Spec Alignment Examples SPF Strict Identifier Alignment Authentication-Results: mx.mail.com; spf=pass (mail.com: domain of designates as permitted sender) From: "Postmaster" SPF domain = example.com From domain = example.com
23 DMARC Spec Alignment Examples DKIM Strict Identifier Alignment Authentication-Results: mx.mail.com; spf=neutral (mail.com: domain of does not designate as permitted sender) dkim=pass DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=s q2; c=relaxed/simple; q=dns/txt; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" DKIM domain = example.com From domain = example.com
24 DMARC Spec Alignment Examples SPF and DKIM Strict Unaligned Authentication-Results: mx.mail.com; spf=pass (mail.com: domain of designates as permitted sender) dkim=fail DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=s q2; c=relaxed/simple; q=dns/txt; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" SPF domain = phish.com From domain = example.com
25 DMARC Spec Alignment Examples SPF and DKIM Strict Unaligned Authentication-Results: mx.mail.com; spf=pass (mail.com: domain of designates as permitted sender) dkim=pass DKIM-Signature: v=1; a=rsa-sha256; d=bar.example.com; s=s q2; c=relaxed/simple; q=dns/txt; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" SPF domain = foo.example.com DKIM domain = bar.example.com From domain = example.com
26 DMARC Spec Alignment Examples SPF and DKIM Relaxed Alignment Authentication-Results: mx.mail.com; spf=pass (mail.com: domain of designates as permitted sender) dkim=pass DKIMSignature: v=1; a=rsa-sha256; d=bounce.example.com; s=s q2; c=relaxed/simple; q=dns/txt; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw +RxSbQiRlaCcwZpXTF/xjWk0xjYl/8S0UUvtFPHZ1l 0cy+svp5ymrqBgnDEN/ ZQEcfmzYEOg1BNL/ I8zlMKPmVOf/9cLIpTVbaWi/G2VBY LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" SPF domain = bounce.example.com SPF Organizational domain = example.com DKIM domain = bounce.example.com DKIM Organizational domain = example.com From domain = foo.example.com From Organizational domain = example.com
27 DMARC Spec Alignment Examples SPF Relaxed Alignment Authentication-Results: mx.mail.com; spf=pass (mail.com: domain of designates as permitted sender) From: "Postmaster" SPF domain = example.com SPF Organizational domain = example.com From domain = example.com From Organizational domain = example.com
28 DMARC Spec Alignment Examples DKIM Relaxed Alignment Authentication-Results: mx.mail.com; spf=neutral (mail.com: domain of does not designate as permitted sender) dkim=pass DKIM-Signature: v=1; a=rsa-sha256; d=foo.example.com; s=s q2; c=relaxed/simple; q=dns/txt; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" DKIM domain = foo.example.com DKIM Organizational domain = example.com From domain = example.com From Organizational domain = example.com
29 DMARC Spec Alignment Examples SPF and DKIM Relaxed Unaligned Authentication-Results: mx.mail.com; spf=pass (mail.com: domain of designates as permitted sender) dkim=fail DKIM-Signature: v=1; a=rsa-sha256; d=bar.example.com; s=s q2; c=relaxed/simple; q=dns/txt; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" SPF domain = phish.com SPF Organizational domain = phish.com From domain = example.com From Organizational domain = example.com
30 DMARC Spec Alignment Exercises Exercise 1 Is SPF in Strict Alignment? Return-Path:postmaster@example.com Authentication-Results: mx.mail.com; spf=neutral (mail.com: domain of postmaster@example.com does not designate as permitted sender) smtp.mail=postmaster@example.com; dkim=pass header.i=@example.com DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@example.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" <postmaster@example.com>
31 DMARC Spec Alignment Exercises Exercise 1 Is SPF in Strict Alignment? Return-Path:postmaster@example.com Authentication-Results: mx.mail.com; spf=neutral (mail.com: domain of postmaster@example.com does not designate as permitted sender) smtp.mail=postmaster@example.com; dkim=pass header.i=@example.com DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@example.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" <postmaster@example.com> Answer: No, SPF did not pass. Is the Aligned anyway?
32 DMARC Spec Alignment Exercises Exercise 1 Is SPF in Strict Alignment? Return-Path:postmaster@example.com Authentication-Results: mx.mail.com; spf=neutral (mail.com: domain of postmaster@example.com does not designate as permitted sender) smtp.mail=postmaster@example.com; dkim=pass header.i=@example.com DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@example.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" <postmaster@example.com> Answer: No, SPF did not pass. Is the Aligned anyway? Answer: Yes, DKIM is in Strict Alignment, so the is Aligned regardless.
33 DMARC Spec Alignment Exercises Exercise 2 Is SPF in Relaxed Alignment? Return-Path:postmaster@foo.example.com Authentication-Results: mx.mail.com; spf=pass (mail.com: domain of postmaster@example.com designates as permitted sender) smtp.mail=postmaster@example.com; dkim=pass header.i=@bar.example.com DKIM-Signature: v=1; a=rsa-sha256; d=bar.example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@facebookmail.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" <postmaster@example.com>
34 DMARC Spec Alignment Exercises Exercise 2 Is SPF in Relaxed Alignment? Return-Path:postmaster@foo.example.com Authentication-Results: mx.mail.com; spf=pass (mail.com: domain of postmaster@example.com designates as permitted sender) smtp.mail=postmaster@example.com; dkim=pass header.i=@bar.example.com DKIM-Signature: v=1; a=rsa-sha256; d=bar.example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@facebookmail.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" <postmaster@example.com> Answer: Yes, foo.example.com shares the same Organizational domain as example.com.
35 DMARC Spec Alignment Exercises Exercise 3 Is DKIM in Strict Alignment? Return-Path:postmaster@example.com Authentication-Results: mx.mail.com; spf=neutral (mail.com: domain of postmaster@example.com does not designate as permitted sender) smtp.mail=postmaster@example.com; dkim=pass header.i=@foo.example.com DKIM-Signature: v=1; a=rsa-sha256; d=foo.example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@foo.example.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" <postmaster@example.com>
36 DMARC Spec Alignment Exercises Exercise 3 Is DKIM in Strict Alignment? Return-Path:postmaster@example.com Authentication-Results: mx.mail.com; spf=neutral (mail.com: domain of postmaster@example.com does not designate as permitted sender) smtp.mail=postmaster@example.com; dkim=pass header.i=@foo.example.com DKIM-Signature: v=1; a=rsa-sha256; d=foo.example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@foo.example.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" <postmaster@example.com> Answer: No, foo.example.com does not exactly match example.com Under what conditions would the be Aligned?
37 DMARC Spec Alignment Exercises Exercise 3 Is DKIM in Strict Alignment? Return-Path:postmaster@example.com Authentication-Results: mx.mail.com; spf=neutral (mail.com: domain of postmaster@example.com does not designate as permitted sender) smtp.mail=postmaster@example.com; dkim=pass header.i=@foo.example.com DKIM-Signature: v=1; a=rsa-sha256; d=foo.example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@foo.example.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" <postmaster@example.com> Answer: No, foo.example.com does not exactly match example.com Under what conditions would the be Aligned? Answer: Since SPF does not pass, the would only be Aligned if Relaxed DKIM Alignment was allowed.
38 DMARC Spec Alignment Exercises Exercise 4 Under what conditions would this be considering in Alignment? Return-Path:postmaster@foo.example.com Authentication-Results: mx.mail.com; spf=neutral (mail.com: domain of postmaster@example.com does not designate as permitted sender) smtp.mail=postmaster@foo.example.com; dkim=fail header.i=@bar.example.com DKIM-Signature: v=1; a=rsa-sha256; d=bar.example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@bar.example.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" <postmaster@example.com>
39 DMARC Spec Alignment Exercises Exercise 4 Under what conditions would this be considering in Alignment? Return-Path:postmaster@foo.example.com Authentication-Results: mx.mail.com; spf=neutral (mail.com: domain of postmaster@example.com does not designate as permitted sender) smtp.mail=postmaster@foo.example.com; dkim=fail header.i=@bar.example.com DKIM-Signature: v=1; a=rsa-sha256; d=bar.example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@bar.example.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" <postmaster@example.com> Answer: None. Neither DKIM nor SPF are valid. Assuming DKIM and SPF were actually valid, under what conditions would this be considered Aligned?
40 DMARC Spec Alignment Exercises Exercise 4 Under what conditions would this be considering in Alignment? Return-Path:postmaster@foo.example.com Authentication-Results: mx.mail.com; spf=neutral (mail.com: domain of postmaster@example.com does not designate as permitted sender) smtp.mail=postmaster@foo.example.com; dkim=fail header.i=@bar.example.com DKIM-Signature: v=1; a=rsa-sha256; d=bar.example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@bar.example.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" <postmaster@example.com> Answer: None. Neither DKIM nor SPF are valid. Assuming DKIM and SPF were actually valid, under what conditions would this be considered Aligned? Answer: If Relaxed Alignment was allowed for either DKIM or SPF, the would be Aligned.
41 This has been the second of six DMARC video segments View the entire M3AAWG DMARC Training Series from the public training video pages on the M3AAWG website at: Our thanks to Michael Adkins, Paul Midgen and DMARC.org for developing the material in this series and allowing M3AAWG to videotape it for professionals worldwide. This video is presented by the Messaging, Malware and Mobile Anti-Abuse Working Group slide PDF files and video copyrighted by the Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG
42 For information about M3AAWG: Contact us at:
43 M 3 AAWG DMARC Training Series Mike Adkins, Paul Midgen DMARC.org October 22, 2012
44 M3AAWG DMARC Training Videos (2.5 hours of training) This is Segment 3 of 6 The complete series of DMARC training videos is available at: Segment 1 Segment 2 Segment 3 What is DMARC? DMARC Identifier Alignment DMARC Policy Records (about 20 minutes) (about 30 minutes) (about 20 minutes) Segment 4 DMARC Reporting (about 15 minutes) Segment 5 Segment 6 DMARC Information for Mailbox Providers DMARC Information for Domain Owners and 3rd Parties (about 20 minutes) (about 40 minutes)
45 DMARC Policy Records DMARC Segment 3 about 30 minutes Mike Adkins, Paul Midgen, DMARC.org October 22, 2012
46 DMARC Spec Policy Records TXT records in DNS _dmarc.example.com Check for a record at the exact RFC5322.From If no record is found, check for a record at the Organizational domain of the RFC5322.From Policy options: none simply monitor and supply feedback quarantine process with high degree of suspicion reject do not accept that fails DMARC check
47 DMARC Spec Policy Records Tag Purpose Example v Protocol Version v=dmarc1 p Policy for the domain p=quarantine sp Policy for subdomains sp=reject pct % of messages subject to policy pct=20 adkim Alignment mode for DKIM adkim=s aspf Alignment mode for SPF aspf=r rua Reporting URI for aggregate reports rua=mailto:aggrep@example.com ruf Reporting URI of forensic reports ruf=mailto:authfail@example.com rf Forensic reporting format rf=afrf ri Aggregate reporting interval ri=14400
48 DMARC Spec Example Policy Records Everyone s first DMARC record v=dmarc1; p=none; rua=mailto:aggregate@example.com;
49 DMARC Spec Example Policy Records Dipping a toe in the pool v=dmarc1; p=quarantine; pct=10; rua=mailto:agg@ex.com; ruf=mailto:fail@ex.com;
50 DMARC Spec Example Policy Records Very aggressive. 100% reject. dig -t TXT _dmarc.facebookmail.com v=dmarc1; p=reject; pct=100;
51 DMARC Spec Policy Record Exercises Exercise 1 Is this a valid record? p=none; pct=50; rua=postmaster@example.com;
52 DMARC Spec Policy Record Exercises Exercise 1 Is this a valid record? p=none; pct=50; rua=postmaster@example.com; Answer: No. The v= tag is required.
53 DMARC Spec Policy Record Exercises Exercise 2 What DNS TXT record will be queried for mail from foo.example.com?
54 DMARC Spec Policy Record Exercises Exercise 2 What DNS TXT record will be queried for mail from foo.example.com? Answer: _dmarc.foo.example.com If no record is found, what will happen?
55 DMARC Spec Policy Record Exercises Exercise 2 What DNS TXT record will be queried for mail from foo.example.com? Answer: _dmarc.foo.example.com If no record is found, what will happen? Answer: _dmarc.example.com will be queried.
56 DMARC Spec Policy Record Exercises Exercise 3 Given this record for _dmarc.example.com: v=dmarc1; p=none; rua=postmaster@example.com; Is this Aligned? Return-Path:postmaster@foo.example.com Authentication-Results: mx.mail.com; spf=pass (mail.com: domain of postmaster@example.com designates as permitted sender) smtp.mail=postmaster@foo.example.com; dkim=pass header.i=@bar.example.com DKIM-Signature: v=1; a=rsa-sha256; d=bar.example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@bar.example.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" <postmaster@example.com>
57 DMARC Spec Policy Record Exercises Exercise 3 Given this record for _dmarc.example.com: v=dmarc1; p=none; rua=postmaster@example.com; Is this Aligned? Return-Path:postmaster@foo.example.com Authentication-Results: mx.mail.com; spf=pass (mail.com: domain of postmaster@example.com designates as permitted sender) smtp.mail=postmaster@foo.example.com; dkim=pass header.i=@bar.example.com DKIM-Signature: v=1; a=rsa-sha256; d=bar.example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@bar.example.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" <postmaster@example.com> Answer: Yes. Alignment is Relaxed by default.
58 DMARC Spec Policy Record Exercises Exercise 4 Given this record for _dmarc.example.com: v=dmarc1; p=none; rua=postmaster@example.com; adkim=s; aspf=r; Is this Aligned? Return-Path:postmaster@example.com Authentication-Results: mx.mail.com; spf=neutral (mail.com: domain of postmaster@example.com does not designate as permitted sender) smtp.mail=postmaster@example.com; dkim=pass header.i=@foo.example.com DKIM-Signature: v=1; a=rsa-sha256; d=foo.example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@foo.example.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" <postmaster@example.com>
59 DMARC Spec Policy Record Exercises Exercise 4 Given this record for _dmarc.example.com: v=dmarc1; p=none; rua=postmaster@example.com; adkim=s; aspf=r; Is this Aligned? Return-Path:postmaster@example.com Authentication-Results: mx.mail.com; spf=neutral (mail.com: domain of postmaster@example.com does not designate as permitted sender) smtp.mail=postmaster@example.com; dkim=pass header.i=@foo.example.com DKIM-Signature: v=1; a=rsa-sha256; d=foo.example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@foo.example.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" <postmaster@example.com> Answer: No. SPF did not pass. DKIM passed, but DKIM Alignment is in strict mode and the DKIM domain does not exactly match the From domain.
60 DMARC Spec Policy Record Exercises Exercise 4 Given this record for _dmarc.example.com: v=dmarc1; p=none; rua=postmaster@example.com; adkim=s; aspf=r; Is this Aligned? Return-Path:postmaster@example.com Authentication-Results: mx.mail.com; spf=neutral (mail.com: domain of postmaster@example.com does not designate as permitted sender) smtp.mail=postmaster@example.com; dkim=pass header.i=@foo.example.com DKIM-Signature: v=1; a=rsa-sha256; d=foo.example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@foo.example.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" <postmaster@example.com> Then what will happen to the ?
61 DMARC Spec Policy Record Exercises Exercise 4 Given this record for _dmarc.example.com: v=dmarc1; p=none; rua=postmaster@example.com; adkim=s; aspf=r; Is this Aligned? Return-Path:postmaster@example.com Authentication-Results: mx.mail.com; spf=neutral (mail.com: domain of postmaster@example.com does not designate as permitted sender) smtp.mail=postmaster@example.com; dkim=pass header.i=@foo.example.com DKIM-Signature: v=1; a=rsa-sha256; d=foo.example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@foo.example.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" <postmaster@example.com> Then what will happen to the ? Answer: No policy action will be taken. The results will be included in the requested aggregate report and the message will be processed as normal.
62 DMARC Spec Policy Record Exercises Exercise 5 Given this record for _dmarc.example.com: v=dmarc1; p=none; rua=postmaster@example.com; ruf=postmaster@example.com adkim=s; aspf=s; sp=reject; Is this Aligned? Return-Path:postmaster@example.com Authentication-Results: mx.mail.com; spf=pass (mail.com: domain of postmaster@example.com does not designate as permitted sender) smtp.mail=postmaster@example.com; dkim=pass header.i=@foo.example.com DKIM-Signature: v=1; a=rsa-sha256; d=foo.example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@foo.example.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" <postmaster@bar.example.com>
63 DMARC Spec Policy Record Exercises Exercise 5 Given this record for _dmarc.example.com: v=dmarc1; p=none; rua=postmaster@example.com; ruf=postmaster@example.com adkim=s; aspf=s; sp=reject; Is this Aligned? Return-Path:postmaster@example.com Authentication-Results: mx.mail.com; spf=pass (mail.com: domain of postmaster@example.com does not designate as permitted sender) smtp.mail=postmaster@example.com; dkim=pass header.i=@foo.example.com DKIM-Signature: v=1; a=rsa-sha256; d=foo.example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@foo.example.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" <postmaster@bar.example.com> Answer: Trick question It depends on whether or not there is a DMARC record at _dmarc.bar.example.com.
64 DMARC Spec Policy Record Exercises Exercise 5 Given this record for _dmarc.example.com: v=dmarc1; p=none; rua=postmaster@example.com; ruf=postmaster@example.com adkim=s; aspf=s; sp=reject; If there is no record at _dmarc.bar.example.com, is this Aligned? Return-Path:postmaster@example.com Authentication-Results: mx.mail.com; spf=pass (mail.com: domain of postmaster@example.com does not designate as permitted sender) smtp.mail=postmaster@example.com; dkim=pass header.i=@foo.example.com DKIM-Signature: v=1; a=rsa-sha256; d=foo.example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@foo.example.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" postmaster@bar.example.com
65 DMARC Spec Policy Record Exercises Exercise 5 Given this record for _dmarc.example.com: v=dmarc1; p=none; rua=postmaster@example.com; ruf=postmaster@example.com adkim=s; aspf=s; sp=reject; If there is no record at _dmarc.bar.example.com, is this Aligned? Return-Path:postmaster@example.com Authentication-Results: mx.mail.com; spf=pass (mail.com: domain of postmaster@example.com does not designate as permitted sender) smtp.mail=postmaster@example.com; dkim=pass header.i=@foo.example.com DKIM-Signature: v=1; a=rsa-sha256; d=foo.example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@foo.example.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" postmaster@bar.example.com Answer: No. Both SPF and DKIM are in Strict Alignment mode and neither exactly match the From domain.
66 DMARC Spec Policy Record Exercises Exercise 5 Given this record for _dmarc.example.com: v=dmarc1; p=none; rua=postmaster@example.com; ruf=postmaster@example.com adkim=s; aspf=s; sp=reject; If there is no record at _dmarc.bar.example.com, is this Aligned? Return-Path:postmaster@example.com Authentication-Results: mx.mail.com; spf=pass (mail.com: domain of postmaster@example.com does not designate as permitted sender) smtp.mail=postmaster@example.com; dkim=pass header.i=@foo.example.com DKIM-Signature: v=1; a=rsa-sha256; d=foo.example.com; s=s q2; c=relaxed/simple; q=dns/txt; i=@foo.example.com; t= ; h=from:subject:date:to:mimeversion:content-type; bh=0l5o8r4ftepbr083mbupe0mirwkrs5yt46dr6cgk/mk=; b=t6m3zvppp3olgnqvor/llw+rxsbqirlaccwzpxtf/xjwk0xjyl/8s0uuvtfphz1l 0cy +svp5ymrqbgnden/zqecfmzyeog1bnl/i8zlmkpmvof/9cliptvbawi/g2vby LXONpLsSymtoeqTBYOOJqoiNLzDNP01pVgZYunf8h90=; From: "Postmaster" postmaster@bar.example.com Then what will happen to the ? Answer: It will be rejected due to the subdomain policy action sp=reject. The results will be included in the requested aggregate report, and a forensic report will be sent.
67 This has been the third of six DMARC video segments View the entire M3AAWG DMARC Training Series from the public training video pages on the M3AAWG website at: Our thanks to Michael Adkins, Paul Midgen and DMARC.org for developing the material in this series and allowing M3AAWG to videotape it for professionals worldwide. This video is presented by the Messaging, Malware and Mobile Anti-Abuse Working Group slide PDF files and video copyrighted by the Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG
68 For information about M3AAWG: Contact us at:
69 M 3 AAWG DMARC Training Series Mike Adkins, Paul Midgen DMARC.org October 22, 2012
70 M3AAWG DMARC Training Videos (2.5 hours of training) This is Segment 4 of 6 The complete series of DMARC training videos is available at: Segment 1 Segment 2 Segment 3 What is DMARC? DMARC Identifier Alignment DMARC Policy Records (about 20 minutes) (about 30 minutes) (about 20 minutes) Segment 4 DMARC Reporting (about 15 minutes) Segment 5 Segment 6 DMARC Information for Mailbox Providers DMARC Information for Domain Owners and 3rd Parties (about 20 minutes) (about 40 minutes)
71 DMARC Reporting DMARC Segment 4 about 15 minutes Paul Midgen, DMARC.org October 22, 2012
72 DMARC Spec Reporting Aggregate Reports Each report covers one RFC5322.From domain. You should get one from each supporting mailbox provider that sees with your From domain. Daily by default, adjustable with ri= tag. Hourly : ri=3600 XML Format Organized by sending IP address Contains Authentication Results (DKIM, SPF) Alignment Results Policy actions taken Reasons for not taking policy actions Just publish a record to see one
73 DMARC Spec Reporting XML Format The policy they found. <policy_published> <domain>facebookmail.com</domain> <adkim>r</adkim> <aspf>r</aspf> <p>reject</p> <sp>none</sp> <pct>100</pct> </policy_published>
74 DMARC Spec Reporting XML Format An example record. <record> <row> <source_ip> </source_ip> <count>1</count> <policy_evaluated> <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </policy_evaluated> </row> <identifiers> <header_from>facebookmail.com</header_from> </identifiers> <auth_results> <dkim> <domain>facebookmail.com</domain> <result>pass</result> </dkim> <spf> <domain>null</domain> <result>none</result> </spf> </auth_results> </record>
75 DMARC Spec Reporting Forensic Reports One per DMARC failure AFRF or IODEF formats Should include call-to-action URIs Throttling Privacy issues Might be redacted Might not be supported
76 DMARC Spec Reporting DMARC URLs Advertise the maximum report size a destination URI will accept mailto:aggregate@example.com25m Works for both report types.
77 DMARC Spec Reporting Verifying 3rd party report destinations If the record for example.com contains reporting URIs at other domains: Report generators should verify that foo.com expects the reports by looking for: example.com._report._dmarc.foo.com The 3rd party can change the URI to a different address in their domain: v=dmarc1; rua=mailto:reports@foo.com
78 This has been the fourth of six DMARC video segments View the entire M3AAWG DMARC Training Series from the public training video pages on the M3AAWG website at: Our thanks to Michael Adkins, Paul Midgen and DMARC.org for developing the material in this series and allowing M3AAWG to videotape it for professionals worldwide. This video is presented by the Messaging, Malware and Mobile Anti-Abuse Working Group slide PDF files and video copyrighted by the Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG
79 For information about M3AAWG: Contact us at:
80 M 3 AAWG DMARC Training Series Mike Adkins, Paul Midgen DMARC.org October 22, 2012
81 M3AAWG DMARC Training Videos (2.5 hours of training) This is Segment 5 of 6 The complete series of DMARC training videos is available at: Segment 1 Segment 2 Segment 3 What is DMARC? DMARC Identifier Alignment DMARC Policy Records (about 20 minutes) (about 30 minutes) (about 20 minutes) Segment 4 DMARC Reporting (about 15 minutes) Segment 5 Segment 6 DMARC Information for Mailbox Providers DMARC Information for Domain Owners and 3rd Parties (about 20 minutes) (about 40 minutes)
82 DMARC Information for Mailbox Providers DMARC Segment 5 about 20 minutes Paul Midgen, DMARC.org October 22, 2012
83 Information for Mailbox Providers Are you ready for DMARC? Do you need DMARC? Understand what DMARC does for the messaging ecosystem. Who are you receiving mail from? Review your SPF and DKIM practices. Why validate both? Develop a local-policy strategy. Special cases Trusted domains Commit to Reporting Outbound?
84 Information for Mailbox Providers Policy Enforcement in Review Evaluate SPF & DKIM according to the RFC. Bonus points: use Authentication-Results Select applicable authentication results using alignment. This only determines whether the results are used. No aligned and passing results? DMARC validation has failed time to enforce None: message disposition is unchanged; report only Quarantine: don t deliver to the inbox. Reject: don t deliver at all.
85 Information for Mailbox Providers Reporting in Review Aggregate Reporting XML data correlating IPs, domains, and authentication results. Requires ability to aggregate & store data extracted from inbound messages. This can require a lot of storage. Specification is currently least-documented part of DMARC, join dmarc-discuss and ask questions. Failure Reporting Copies of messages failing DMARC validation sent to the sender or their agent. Don t queue. Sending as close to receipt as possible maximizes value.
86 Information for Mailbox Providers Operational Considerations y ll a u s u v DMARC policy is the sender s policy and should have higher priority than local and other policy. Consider ways to mitigate the impact of MLMs, forwarders, and so on. These waters are deep. Fish with large teeth. Be deliberate, researched, and iterative.
87 Information for Mailbox Providers Reporting and Privacy Forensic reports can send an unaltered message to someone other than the intended recipient. It may not be from a bad actor. Do a privacy review Understand applicable privacy regimes before sending reports. Corporate Federal/Legal Only one US-based MBP is sending failure reports
88 Resources Dmarc.org Resources page for tools Participate page for list sign up
89 This has been the fifth of six DMARC video segments View the entire M3AAWG DMARC Training Series from the public training video pages on the M3AAWG website at: Our thanks to Michael Adkins, Paul Midgen and DMARC.org for developing the material in this series and allowing M3AAWG to videotape it for professionals worldwide. Thanks to Message Bus for additional videotaping and to videographer Ilana Rothman. This video is presented by the Messaging, Malware and Mobile Anti-Abuse Working Group slide PDF files and video copyrighted by the Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG
90 For information about M3AAWG: Contact us at:
91 M 3 AAWG DMARC Training Series Mike Adkins, Paul Midgen DMARC.org October 22, 2012
92 M3AAWG DMARC Training Videos (2.5 hours of training) This is Segment 6 of 6 The complete series of DMARC training videos is available at: Segment 1 Segment 2 Segment 3 What is DMARC? DMARC Identifier Alignment DMARC Policy Records (about 20 minutes) (about 30 minutes) (about 20 minutes) Segment 4 DMARC Reporting (about 15 minutes) Segment 5 Segment 6 DMARC Information for Mailbox Providers DMARC Information for Domain Owners and 3rd Parties (about 20 minutes) (about 40 minutes)
93 DMARC Information for Doman Owners and 3 rd Parties DMARC Segment 6 about 40 minutes Michael Adkins, DMARC.org and M 3 AAWG Co-Vice Chairman October 22, 2012
94 Information for Domain Owners The Reporting and Compliance Process Initial Record Publishing 3rd Party Deployment Profiles Report Processing and Analysis Rolling out Policies Long Term Monitoring
95 The Reporting and Compliance Process For Domain Owners Phase 1: Initial Auditing Publish Initial Record Assess Initial Threat Level Phase 2: Initial Policy Ramp-up Process Reports Fix Infrastructure Issues Process Reports No Abuse Detected Abuse Detected Make Policy Changes Phase 3: Ongoing Monitoring Process Reports Assess Current Threat Level Fix Infrastructure Issues Make Policy Changes / Other Response
96 Initial Record Publishing Everyone s first DMARC record v=dmarc1; p=none; rua=mailto:aggregate@example.com;
97 3rd Party Deployment Profiles Controlled The Domain Owner fully controls their own DNS, and wants as much control over their as possible. Controlled Control / Visibility Authorized Delegated Hosted Technical Responsibility Authorized The Domain Owner lets the 3rd party dictate the content of some DNS records, while still retaining some operational control. Delegated The Domain Owner delegates control of their DNS to the 3rd party, and wants to be mostly hands-off with their . Hosted The Domain Owner allows the 3rd party to handle everything, and has little control
98 3rd Party Deployment Profiles Controlled The Domain Owner retains control of the domain or subdomain, provides a DKIM signing key to 3rd party and publishes the public key, and includes the appropriate information in their SPF record. Pro This scenario allows 3rd parties to send as the organizational domain if desired. The Domain Owner retains operational control. Cons Coordination between the domain owner and the 3rd party mailer is required to ensure proper DKIM key rotation, accurate SPF records, etc. Risk of coordination overhead/issues increases as the number of bilateral relationships increase for domain owners and vendors.
99 3rd Party Deployment Profiles Controlled Contractual points Process for DKIM key rotation. Obligations of each party, including testing. SPF record requirements and process for adding new hosts.
100 3rd Party Deployment Profiles Authorized Similar to Controlled Profile, except the 3rd party creates the DKIM key pair and generally takes a more active role in dictating record content. This approach is useful for Domain Owners where a different 3rd party is providing DNS and other services for the domain. Pros Can streamline provisioning for the 3rd party. One less task for the Domain Owner. Cons Can create additional management issues for Domain Owners who use multiple 3rd parties. Possible additional contractual point for key strength requirements.
101 3rd Party Deployment Profiles Delegated The Domain Owner delegates a subdomain to 3rd party mailer and relies on contractual relationship to ensure appropriate SPF records, DKIM signing, and DMARC records. Pros Reduces Domain Owner implementation issues to mostly contractual. The 3rd party is responsible for SPF records, DKIM signing and publishing, etc. Domain owner may still be responsible for ensuring Identifier Alignment. Con The Domain Owner potentially gives up day to day control and visibility into operations and conformance.
102 3rd Party Deployment Profiles Delegated Contractual points Creation and maintenance of SPF, DKIM and DMARC records (Quarterly) Rotation of DKIM keys and minimum length of key (1024 recommended) Investigation of DMARC rejections Handling of DMARC Reports Requirements for reporting back to the Domain Owner Indemnification (if any) for mail lost due to improper records or signatures.
103 3rd Party Deployment Profiles Hosted The 3rd party is also providing DNS, webhosting, etc for the Domain Owner and makes the process mostly transparent to the domain owner. Pro Very easy for less sophisticated Domain Owners. Can be mostly automated by the 3rd party. Con The domain owner is significantly more dependent on the 3rd party.
104 3rd Party Deployment Profiles 3rd Party responsibilities Controlled Authorized Delegated Hosted Provide SPF record content Y Y Y Y Maintain SPF records N N Y Y Maintain DKIM records N N Y Y Create DKIM Keys N Y Y Y Rotate DKIM Keys Y Y Y Y Maintain DMARC Records N N Y Y Process DMARC reports N?? Y
105 Report Processing and Analysis Phase 1: Initial Auditing Publish Initial Record Assess Initial Threat Level Phase 2: Initial Policy Ramp-up Process Reports Fix Infrastructure Issues Process Reports No Abuse Detected Abuse Detected Make Policy Changes Phase 3: Ongoing Monitoring Process Reports Assess Current Threat Level Fix Infrastructure Issues Make Policy Changes / Other Response
106 Report Processing and Analysis Report Parsing Tools If you develop report parsing tools you are willing to share, please send a note to the dmarc-discuss list and let us know.
107 Report Processing and Analysis Step 1: Categorize the IPs in the Aggregate Report Your Infrastructure Authorized 3rd Parties Unauthorized 3rd Parties * * - You should consider everything an Unauthorized 3rd Party by default.
108 Report Processing and Analysis Infrastructure Auditing Step 2: Infrastructure Auditing For both your Infrastructure and Authorized 3rd Parties Identify owners LOE for Deploying Domain Authentication LOE for Identifier Alignment Business case / Justification
109 Report Processing and Analysis Step 3: Identify Malicious Research Unauthorized 3rd Parties and label the Abusers Use public data sources Vendor services Look for known failure cases Forensic reports
M 3 AAWG DMARC Training Series. Mike Adkins, Paul Midgen DMARC.org October 22, 2012
M 3 AAWG DMARC Training Series Mike Adkins, Paul Midgen DMARC.org October 22, 2012 M3AAWG DMARC Training Videos (2.5 hours of training) This is Segment 3 of 6 The complete series of DMARC training videos
M 3 AAWG DMARC Training Series. Mike Adkins, Paul Midgen DMARC.org October 22, 2012
M 3 AAWG DMARC Training Series Mike Adkins, Paul Midgen DMARC.org October 22, 2012 M3AAWG DMARC Training Videos (2.5 hours of training) This is Segment 6 of 6 The complete series of DMARC training videos
M 3 AAWG DMARC Training Series. Mike Adkins, Paul Midgen DMARC.org October 22, 2012
M 3 AAWG DMARC Training Series Mike Adkins, Paul Midgen DMARC.org October 22, 2012 M3AAWG DMARC Training Videos (2.5 hours of training) This is Segment 1 of 6 The complete series of DMARC training videos
Securing, Protecting, and Managing the Flow of Corporate Communications
Securing, Protecting, and Managing the Flow of Corporate Communications Getting mailflow right Dave Stork Technical Consultant OGD ict-diensten QR: URL to Presentation Who am I? Dave Stork Technical consultant
2016 Online Trust Audit Authentication Practices Deep Dive & Reality Check
2016 Online Trust Audit Email Authentication Practices Deep Dive & Reality Check July 20, 2016 Craig Spiezle Executive Director Online Trust Alliance https://otalliance.org/dmarc 2016 All rights reserved.
building an effective action plan for the Department of Homeland Security
Customer Guide building an effective action plan for the Department of Homeland Security Binding The recently issued directive from the Department of Homeland Security (DHS), Binding Operational Directive
ISSN: March Domain-based Message Authentication, Reporting, and Conformance (DMARC)
Independent Submission Request for Comments: 7489 Category: Informational ISSN: 2070-1721 M. Kucherawy, Ed. E. Zwicky, Ed. Yahoo! March 2015 Domain-based Message Authentication, Reporting, and Conformance
DMARC Continuing to enable trust between brand owners and receivers
DMARC Continuing to enable trust between brand owners and receivers February 2014 1 DMARC Defined DMARC stands for: Domain-based Message Authentication, Reporting & Conformance (pronounced dee-mark ) 2
Office 365: Secure configuration
Office 365: Secure email configuration Published September 2017 Copyright 2017 Health and Social Care Information Centre. The Health and Social Care Information Centre is a non-departmental body created
About Us. Overview Integrity Audit Fighting Malicious & Deceptive August 13, 2014
2014 Email Integrity Audit Fighting Malicious & Deceptive Email August 13, 2014 Craig Spiezle Executive Director & President, OTA Mike Jones Director of Product Management, Agari About Us The Online Trust
Designing an open source DMARC aggregation tool
Research project 2 Designing an open source DMARC aggregation tool Yadvir Singh supervised by Michiel Leenaars August 17, 2016 Abstract DMARC provides a standard for interaction between a domain owner
Design and Implementation of a DMARC Verification Result Notification System
Proceedings of the APAN Research Workshop 2016 ISBN 978-4-9905448-6-7 Design and Implementation of a DMARC Verification Result Notification System Naoya Kitagawa, Toshiki Tanaka, Masami Fukuyama and Nariyoshi
Towards authentication
Towards email authentication TLS SPF + DKIM + DMARC 2012/10/03 Roberto Innocente 1 Who adopted it? Hotmail.com Gmail.com AOL.com Verizon.com Ebay Paypal Yahoo.com 2012/10/03 Roberto Innocente 2 Tls/SPF/DKIM/DMARC
Getting Started with DMARC A Guide for Federal Agencies Complying with BOD 18-01
Getting Started with DMARC A Guide for Federal Agencies Complying with BOD 18-01 The DHS Mandate Adopt DMARC for Email Security On October 16, 2017, the U.S. Department of Homeland Security issued a Binding
DomainKeys Identified Mail Overview (-01) Eric Allman Sendmail, Inc.
DomainKeys Identified Mail Overview (-01) Eric Allman Sendmail, Inc. Overview of DKIM Cryptography-based protocol, signs selected header fields and message body Intended to: Enable reliable domain name
Getting Started with DMARC. A Guide for Federal Agencies Complying with BOD 18-01
Getting Started with DMARC A Guide for Federal Agencies Complying with BOD 18-01 The DHS Mandate - Adopt DMARC for Email Security in 90 Days On October 16, 2017, the U.S. Department of Homeland Security
Anti-Spoofing. Inbound SPF Settings
Anti-Spoofing SonicWall Hosted Email Security solution allows you to enable and configure settings to prevent illegitimate messages from entering your organization. Spoofing consists of an attacker forging
DMARC ADOPTION AMONG. SaaS 1000 Q Featuring Matthew Vernhout (CIPP/C) Director of Privacy, 250ok
DMARC ADOPTION AMONG SaaS 1000 Q1 2018 Featuring Matthew Vernhout (CIPP/C) Director of Privacy, 250ok TABLE OF CONTENTS Introduction... 03 Research Overview... 04 SaaS 1000... 05 DMARC Adoption Among SaaS
Based on material produced by among others: Sanjay Pol, Ashok Ramaswami, Jim Fenton and Eric Allman
DKIM Patrik Fältström Based on material produced by among others: Sanjay Pol, Ashok Ramaswami, Jim Fenton and Eric Allman September 22, 2005 1 What is Domain Keys Identified Mail? Method of using cryptographic
Are You Protecting Your & Your Customers? Learnings from the 2017 OTA Trust Audit. August 1, 2017
Are You Protecting Your Email & Your Customers? Learnings from the 2017 OTA Trust Audit August 1, 2017 2017 All rights reserved. Online Trust Alliance (OTA) Slide 1 Panel Kevin Gallant Manager, Intelligence
DMARC ADOPTION AMONG. SaaS 1000 Q Featuring Matthew Vernhout (CIPP/C) Director of Privacy, 250ok
DMARC ADOPTION AMONG SaaS 1000 Q1 2018 Featuring Matthew Vernhout (CIPP/C) Director of Privacy, 250ok TABLE OF CONTENTS Introduction... 03 Research Overview... 04 SaaS 1000... 05 DMARC Adoption Among SaaS
Communicator. Branded Sending Domain July Branded Sending Domain
Branded Sending Domain Communicator Branded Sending Domain July 2017 Version 2.1 This document includes instructions on how to set up a new sender domain and ensure this is configured correctly. Contents
A Federal Agency Guide to Complying with Binding Operational Directive (BOD) 18-01
Table of Contents Introduction... 2 Required Actions Overview... 2 Required Actions Email Security... 3 Required Actions Web Security... 9 Status of Implementation... 11 Roles and Responsibilities... 11
DMARC ADOPTION AMONG
DMARC ADOPTION AMONG Top US Colleges and Universities Q1 2018 Featuring Matthew Vernhout (CIPP/C) Director of Privacy, 250ok TABLE OF CONTENTS Introduction... 03 Research Overview... 04 Top US Colleges
Applications Area Working Group. Intended status: Informational. D. Kodama BIGLOBE Inc. K. Okada Lepidum Co. Ltd. July 28, 2017
Applications Area Working Group Internet-Draft Intended status: Informational Expires: January 29, 2018 G. Yasutaka Rakuten, Inc. T. Akagiri Regumi, Inc. D. Kodama BIGLOBE Inc. K. Okada Lepidum Co. Ltd.
FRAUD DEFENSE: How To Fight The Next Generation of Targeted BEC Attacks
EMAIL FRAUD DEFENSE: How To Fight The Next Generation of Targeted BEC Attacks Brian Westnedge bwestnedge@proofpoint.com November 8, 2017 1 2017 Proofpoint, Inc. THE BUSINESS PROBLEM BUSINESS EMAIL COMPROMISE
2015 Online Trust Audit & Honor Roll Methodology
2015 Online Trust Audit & Honor Roll Methodology Jeff Wilbur VP Marketing, Iconix Craig Spiezle Executive Director & President, OTA 2015 All rights reserved. Online Trust Alliance (OTA) Slide 1 Who Is
DMARC ADOPTION AMONG
DMARC ADOPTION AMONG Top US Colleges and Universities Q1 2018 Featuring Matthew Vernhout (CIPP/C) Director of Privacy, 250ok TABLE OF CONTENTS Introduction... 03 Research Overview... 04 Top US Colleges
Automatic Delivery Setup Guide
for GuideSpark Communicate Cloud Table of Contents Summary: Working with Automatic Email Delivery... 1 What your IT department needs to know... 2 Prerequisite: Select a Targeted Audience... 3 Enable Automatic
Techniques, Tools and Processes to Help Service Providers Clean Malware from Subscriber Systems
Techniques, Tools and Processes to Help Service Providers Clean Malware from Subscriber Systems Barry Raveendran Greene, bgreene@senki.org October 22, 2012, Baltimore, Maryland, USA M3AAWG 26th General
Automatic Delivery Setup Guide
for GuideSpark Communicate Cloud Table of Contents Summary: Working with Automatic Email Delivery... 1 What your IT department needs to know... 2 Prerequisite: Select a Targeted Audience... 3 Enable Automatic
Phishing Discussion. Pete Scheidt Lead Information Security Analyst California ISO
Phishing Discussion Pete Scheidt Lead Information Security Analyst California ISO 2 Phish What is Phishing Types of Phish 3 Phish What is Phishing Attackers (Phishers) would email (cast their nets) far
Extract of Summary and Key details of Symantec.cloud Health check Report
SYMANTEC.CLOUD EXAMPLE HEALTH CHECK SUMMARY REPORT COMPUTER SECURITY TECHNOLOGY LTD. 8-9 Lovat lane, London, London. EC3R 8DW. Tel: 0207 621 9740. Email: info@cstl.com WWW.CSTL.COM Customer: - REDACTED
Using Centralized Security Reporting
This chapter contains the following sections: Centralized Email Reporting Overview, on page 1 Setting Up Centralized Email Reporting, on page 2 Working with Email Report Data, on page 4 Understanding the
DMARC ADOPTION AMONG e-retailers
DMARC ADOPTION AMONG e-retailers Q1 2018 Almost 90% of Top US and EU e-retailer Domains Fail to Protect Consumers from Phishing Attacks Featuring Matthew Vernhout (CIPP/C) Director of Privacy, 250ok TABLE
DKIM Implementation How
DKIM Implementation How Murray S. Kucherawy Principal Engineer, Cloudmark June 8, 2009 Planning Your Deployment Selecting Key Rotation Policy How long do your keys live? Similar in nature to your password
Security by Any Other Name:
Security by Any Other Name: On the Effectiveness of Provider Based Email Security Ian Foster, Jon Larson, Max Masich, Alex C. Snoeren, Stefan Savage, and Kirill Levchenko University of California, San
DMARC ADOPTION AMONG e-retailers
DMARC ADOPTION AMONG e-retailers Q1 2018 Almost 90% of Top US and EU e-retailer Domains Fail to Protect Consumers from Phishing Attacks Featuring Matthew Vernhout (CIPP/C) Director of Privacy, 250ok TABLE
Authentication GUIDE. Frequently Asked QUES T ION S T OGETHER STRONGER
Email Authentication GUIDE Frequently Asked QUES T ION S T OGETHER STRONGER EMAIL AUTHENTICATION Marketers that use email for communication and transactional purposes should adopt and use identification
UK Healthcare: DMARC Adoption Report Security in Critical Condition
UK Healthcare: DMARC Adoption Report Email Security in Critical Condition Executive Summary Email is one of the primary digital channels for digital engagement. But email has never been secure. Phishing
On the Surface. Security Datasheet. Security Datasheet
Email Security Datasheet Email Security Datasheet On the Surface No additional hardware or software required to achieve 99.9%+ spam and malware filtering effectiveness Initiate service by changing MX Record
Trustwave SEG Cloud BEC Fraud Detection Basics
.trust Trustwave SEG Cloud BEC Fraud Detection Basics Table of Contents About This Document 1 1 Background 2 2 Configuring Trustwave SEG Cloud for BEC Fraud Detection 5 2.1 Enable the Block Business Email
An Executive s FAQ About Authentication
An Executive s FAQ About Email Authentication Understanding how email authentication helps your organization protect itself from phishing with an approach that s radically different from other security
Single Sign-On. Introduction
Introduction DeliverySlip seamlessly integrates into your enterprise SSO to give your users total email security and an extra set of robust communications tools. Single sign-on (SSO) systems create a single
Final exam in. Web Security EITF05. Department of Electrical and Information Technology Lund University
Final exam in Web Security EITF05 Department of Electrical and Information Technology Lund University October 22 nd, 2013, 8.00-13.00 You may answer in either Swedish or English. If any data is lacking,
Single Sign-On. Introduction. Feature Sheet
Feature Sheet Single Sign-On Introduction CipherPost Pro seamlessly integrates into your enterprise single sign-on (SSO) to give your users total email security and an extra set of robust communications
Cirius Secure Messaging Single Sign-On
Cirius Secure Messaging seamlessly integrates into your enterprise SSO to give your users total email security and an extra set of robust communications tools. Single sign-on (SSO) systems create a single
A Buyer s Guide to DMARC
0800 133 7127 support@lawyerchecker.co.uk A Buyer s Guide to DMARC Meet the cyber security protocol that reduces phishing attacks and improves email deliverability 1971 First email sent 1982 SMTP established
Competitive Matrix - IRONSCALES vs Alternatives
Competitive Matrix - IRONSCALES vs Alternatives Traditional Awareness and Training Features IRONSCALES SEG PhishMe Wombat Knowbe4 Sans Institute Simulation & Training Compliance PCI/DSS, HIPAA, GLBA to
Best Practices. Kevin Chege
Email Best Practices Kevin Chege Why your email setup is critical Billions of SPAM emails are generated every day The tips here can help you to reduced the chances of you receiving SPAM email or inadvertently
Cyber Security Reliability Standards CIP V5 Transition Guidance:
Cyber Security Reliability Standards CIP V5 Transition Guidance: ERO Compliance and Enforcement Activities during the Transition to the CIP Version 5 Reliability Standards To: Regional Entities and Responsible
Mail Assure Quick Start Guide
Mail Assure Quick Start Guide Version: 11/15/2017 Last Updated: Wednesday, November 15, 2017 CONTENTS Getting Started with Mail Assure 1 Firewall Settings 2 Accessing Mail Assure 3 Incoming Filtering 4
Internet Engineering Task Force (IETF) Request for Comments: 6591 April 2012 Category: Standards Track ISSN:
Internet Engineering Task Force (IETF) H. Fontana Request for Comments: 6591 April 2012 Category: Standards Track ISSN: 2070-1721 Authentication Failure Reporting Using the Abuse Reporting Format Abstract
Teach Me How: B2B Deliverability in a B2C World
Teach Me How: B2B Deliverability in a B2C World Chris Arrendale CEO & Principal Deliverability Strategist Inbox Pros (www.inboxpros.com) @Arrendale Agenda - Outline Delivery versus Deliverability Provisioning
Mail Assure. Quick Start Guide
Mail Assure Quick Start Guide Last Updated: Wednesday, November 14, 2018 ----------- 2018 CONTENTS Firewall Settings 2 Accessing Mail Assure 3 Application Overview 4 Navigating Mail Assure 4 Setting up
Brand Indicators for Message Identification
Brand Indicators for Message Identification IETF104 March, 2019 Alex Brotman Neil Kumaran Seth Blank Wei Chuang Agenda 1. Overview a. Why do this? b. Use cases + Implementers c. Why are we here? d. Common
Internet Engineering Task Force (IETF) Category: Standards Track April 2011 ISSN:
Internet Engineering Task Force (IETF) M. Kucherawy Request for Comments: 6212 Cloudmark, Inc. Category: Standards Track April 2011 ISSN: 2070-1721 Authentication-Results Registration for Vouch by Reference
Implementation Guide for Delivery Notification in Direct
Implementation Guide for Delivery Notification in Direct Contents Change Control... 2 Status of this Guide... 3 Introduction... 3 Overview... 3 Requirements... 3 1.0 Delivery Notification Messages... 4
Technical Brief: DYN DELIVERY
Technical Brief: DYN EMAIL DELIVERY 603 668 4998 Technical Brief: Dyn Email Delivery Introduction Dyn s Email Delivery platform allows reputable senders to send both bulk and transactional emails to their
Sophos Central Partner. help
help Contents About help...1 About...2 Dashboard... 3 Alerts...4 Logs... 5 Audit Logs...5 Sophos Central...7 Sophos Central customers...7 Sophos Central Licenses... 7 Managed Customer Usage... 9 Trial
Building a Scalable, Service-Centric Sender Policy Framework (SPF) System
Valimail White Paper February 2018 Building a Scalable, Service-Centric Sender Policy Framework (SPF) System Introduction Sender Policy Framework (SPF) is the protocol by which the owners of a domain can
Criminal Justice Information Security (CJIS) Guide for ShareBase in the Hyland Cloud
Criminal Justice Information Security (CJIS) Guide for ShareBase in the Hyland Cloud Introduction The Criminal Justice Information Security (CJIS) Policy is a publically accessible document that contains
Sustainable Security Operations
Sustainable Security Operations Optimize processes and tools to make the most of your team s time and talent The number and types of security incidents organizations face daily are steadily increasing,
CIS Controls Measures and Metrics for Version 7
Level One Level Two Level Three Level Four Level Five Level Six 1.1 Utilize an Active Discovery Tool Utilize an active discovery tool to identify devices connected to the organization's network and update
Correlation and Phishing
A Trend Micro Research Paper Email Correlation and Phishing How Big Data Analytics Identifies Malicious Messages RungChi Chen Contents Introduction... 3 Phishing in 2013... 3 The State of Email Authentication...
TrendMicro Hosted Security. Best Practice Guide
TrendMicro Hosted Email Security Best Practice Guide 1 Trend Micro Incorporated reserves the right to make changes to this document and to the products described herein without notice. The names of companies,
TOP 10 IT SECURITY ACTIONS TO PROTECT INTERNET-CONNECTED NETWORKS AND INFORMATION
INFORMATION TECHNOLOGY SECURITY GUIDANCE TOP 10 IT SECURITY ACTIONS TO PROTECT INTERNET-CONNECTED NETWORKS AND INFORMATION ITSM.10.189 October 2017 INTRODUCTION The Top 10 Information Technology (IT) Security
EBOOK. Stopping Fraud. How Proofpoint Helps Protect Your Organization from Impostors, Phishers and Other Non-Malware Threats.
EBOOK Stopping Email Fraud How Proofpoint Helps Protect Your Organization from Impostors, Phishers and Other Non-Malware Threats www.proofpoint.com EBOOK Stopping Email Fraud 2 Today s email attacks have
Security Protection
Email Security Protection Loay Alayadhi Abstract: Email is the most important business communication tool. Security has been an issue in mail from ancient times. Therefore, email security protection has
DKIM Implementation. Segment 4 of 4 on DomainKeys Identified Mail. MAAWG Training Series
DKIM Implementation MAAWG Training Series Segment 4 of 4 on DomainKeys Identified Mail From the onsite training course at the MAAWG 18 th General Meeting San Francisco, February 2010 DKIM Implementation
with Advanced Protection
with Advanced Email Protection OVERVIEW Today s sophisticated threats are changing. They re multiplying. They re morphing into new variants. And they re targeting people, not just technology. As organizations
Security Enhancements
OVERVIEW Security Enhancements February 9, 2009 Abstract This paper provides an introduction to the security enhancements in Microsoft Windows 7. Built upon the security foundations of Windows Vista, Windows
BIG-IP Access Policy Manager : Secure Web Gateway. Version 13.0
BIG-IP Access Policy Manager : Secure Web Gateway Version 13.0 Table of Contents Table of Contents BIG-IP APM Secure Web Gateway Overview...9 About APM Secure Web Gateway... 9 About APM benefits for web
SolarWinds Mail Assure
TECHNICAL PRODUCT DATASHEET SolarWinds Mail Assure Email Protection & Email Archive SolarWinds Mail Assure provides best-in-class protection against email-based threats, such as spam, viruses, phishing,
Netwrix Auditor for SQL Server
Netwrix Auditor for SQL Server Quick-Start Guide Version: 9.5 10/25/2017 Legal Notice The information in this publication is furnished for information use only, and does not constitute a commitment from
Vendor: Cisco. Exam Code: Exam Name: ESFE Cisco Security Field Engineer Specialist. Version: Demo
Vendor: Cisco Exam Code: 650-153 Exam Name: ESFE Cisco Email Security Field Engineer Specialist Version: Demo Question No : 1 In the C-160's factory default configuration, which interface has ssh enabled
DMARC ADOPTION AMONG
DMARC ADOPTION AMONG US and UK Nonprofit Organizations Q2 2018 Featuring Matthew Vernhout (CIPP/C) Director of Privacy, 250ok TABLE OF CONTENTS Introduction... 03 Research Overview... 04 US and UK Nonprofit
Send and Receive Exchange Use Case Test Methods
Send and Receive Exchange Use Case Test Methods Release 1 Version 1.0 October 1, 2017 Send and Receive Exchange Test Methods Release 1 Version 1.0 Technology Sponsor [Name] [Email] [Telephone] Signature
Agari Global DMARC Adoption Report: Open Season for Phishers
Agari Global DMARC Adoption Report: Open Season for Phishers Executive Summary Based on Agari research of public DNS records, 92 percent of all Fortune 500 companies have left their customers and business
CA Security Management
CA Security CA Security CA Security In today s business environment, security remains one of the most pressing IT concerns. Most organizations are struggling to protect an increasing amount of disparate
2015 Online Trust Audit & Honor Roll Review June 23, All rights reserved. Online Trust Alliance (OTA) Slide 1
2015 Online Trust Audit & Honor Roll Review June 23, 2015 Sal Tripi AVP, Publishers Clearing House Jeff Wilbur VP Marketing, Iconix Craig Spiezle Executive Director & President, OTA 2015 All rights reserved.
WHITEPAPER Rewrite Services. Power365 Integration Pro
WHITEPAPER Email Rewrite Services Power365 Integration Pro Table of Contents The Challenge... 3 The Binary Tree Solution... 3 What to Expect... 3 Day 1 Email Rewrite Services... 3 Day 2 Email Rewrite Services...
The Anti-Impersonation Company. Date: May 2 nd, ValiMail. All Rights Reserved. Confidential and Proprietary.
The Email Anti-Impersonation Company Date: May 2 nd, 2017 Email: I need you, but I don t trust you 3 90%+ of cyber attacks start with a phish 4 Anyone can send email in your name Your Company 3 rd -Party
Aligning Agency Cybersecurity Practices with the Cybersecurity Framework
POINT OF VIEW Aligning Agency Cybersecurity Practices with the Cybersecurity Framework Leveraging Gigamon to Align Cybersecurity Budgets with Desired Business Outcomes 2013-2017 Gigamon. All rights reserved.
CIS Controls Measures and Metrics for Version 7
Level 1.1 Utilize an Active Discovery Tool 1.2 Use a Passive Asset Discovery Tool 1.3 Use DHCP Logging to Update Asset Inventory 1.4 Maintain Detailed Asset Inventory 1.5 Maintain Asset Inventory Information
Marketing 201. March, Craig Stouffer, Pinpointe Marketing (408) x125
Email Marketing 201 Tips to Increase Email Delivery (aka Why Good Email Goes Bad ) March, 2009 Craig Stouffer, Pinpointe Email Marketing cstouffer@pinpointe.com (408) 834-7577 x125 Gary Halliwell CEO,
DRAFT REVISIONS BR DOMAIN VALIDATION
DRAFT REVISIONS BR 3.2.2.4 DOMAIN VALIDATION (Feb. 15, 2016) Summary of changes The primary purpose of this change is to replace Domain Validation item 7 "Using any other method of confirmation which has
Zero Trust on the Endpoint. Extending the Zero Trust Model from Network to Endpoint with Advanced Endpoint Protection
Zero Trust on the Endpoint Extending the Zero Trust Model from Network to Endpoint with Advanced Endpoint Protection March 2015 Executive Summary The Forrester Zero Trust Model (Zero Trust) of information
Evaluating Encryption Products
Evaluating Email Encryption Products A Comparison of Virtru and Zix Importance of Email Encryption Most modern email providers, such as Google and Microsoft, offer excellent default security options, but
Vendor: Cisco. Exam Code: Exam Name: Implementing Cisco Threat Control Solutions. Version: Demo
Vendor: Cisco Exam Code: 300-207 Exam Name: Implementing Cisco Threat Control Solutions Version: Demo DEMO QUESTION 1 When learning accept mode is set to auto, and the action is set to rotate, when is
Security and Compliance for Office 365
Security and Compliance for Office 365 [Proofpoint has] given us our time back to focus on the really evil stuff. CISO, Global 500 Manufacturer Like millions of businesses around the world, you may be
Securing Office 365 with SecureCloud
Securing Office 365 with SecureCloud 1 Introduction Microsoft Office 365 has become incredibly popular because of the mobility and collaboration it enables. With Office 365, companies always have the latest
Internet Engineering Task Force (IETF) Request for Comments: ISSN: November 2011
Internet Engineering Task Force (IETF) K. Li Request for Comments: 6430 B. Leiba Category: Standards Track Huawei Technologies ISSN: 2070-1721 November 2011 Abstract Email Feedback Report Type Value: not-spam
Internet Engineering Task Force (IETF) Request for Comments: T. Draegen, Ed. dmarcian, inc. E. Zwicky, Ed. Yahoo K. Andersen, Ed.
Internet Engineering Task Force (IETF) Request for Comments: 7960 Category: Informational ISSN: 2070-1721 F. Martin, Ed. LinkedIn E. Lear, Ed. Cisco Systems GmbH T. Draegen, Ed. dmarcian, inc. E. Zwicky,
Enterprise Cybersecurity Best Practices Part Number MAN Revision 006
Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006 April 2013 Hologic and the Hologic Logo are trademarks or registered trademarks of Hologic, Inc. Microsoft, Active Directory,
10 KEY WAYS THE FINANCIAL SERVICES INDUSTRY CAN COMBAT CYBER THREATS
10 KEY WAYS THE FINANCIAL SERVICES INDUSTRY CAN COMBAT CYBER THREATS WHITE PAPER INTRODUCTION BANKS ARE A COMMON TARGET FOR CYBER CRIMINALS AND OVER THE LAST YEAR, FIREEYE HAS BEEN HELPING CUSTOMERS RESPOND
2018 Edition. Security and Compliance for Office 365
2018 Edition Security and Compliance for Office 365 [Proofpoint has] given us our time back to focus on the really evil stuff. CISO, Global 500 Manufacturer Like millions of businesses around the world,
APCAUCE / APRICOT Kuala Lumpur Dave Crocker Brandenburg InternetWorking <
APCAUCE / APRICOT Kuala Lumpur 2004 Dave Crocker Brandenburg InternetWorking Email is more complex than people usually realize Spam is a social problem Technical solutions
2 Technical Report
2 2.1 Introduction The summarizes the latest trends in spam, technical counter measures to spam, etc. For trends in spam, the results of a variety of analyses conducted based on various information obtained
Avanan for G Suite. Technical Overview. Copyright 2017 Avanan. All rights reserved.
Avanan for G Suite Technical Overview Contents Intro 1 How Avanan Works 2 Email Security for Gmail 3 Data Security for Google Drive 4 Policy Automation 5 Workflows and Notifications 6 Authentication 7