CRAZY! The Email Security Hack Every Small Business Needs – Don't Miss This!

Email - It is one of the most important tools in your business arsenal. This article is not just about sending messages; it's also about ensuring the security, trustworthiness, and credibility of your email communications with your customers. That's where DMARC comes into play. Let’s explore what a DMARC record is. We will answer why it's essential for your business, how to set it up completely free, and how you can verify if your DMARC is setup correctly.

The Importance of DMARC

DMARC, which stands for Domain-based Message Authentication, Reporting, and Conformance, and is a crucial email authentication protocol. It enhances email security, improves your email deliverability, and protects your brand from email spoofing.

1. Email Authentication: DMARC authenticates your email messages with the recipient, ensuring that emails they receive are genuinely sent from your domain. This reduces the chances of cybercriminals impersonating your brand and sending malicious emails to your customers.

2. Protecting Your Brand: Email spoofing is a common tactic used by cybercriminals to deceive recipients by sending emails that appear to be from a legitimate source. These impostors can trick your customers into revealing sensitive information, making them vulnerable to phishing attacks.

Email spoofing is a deceptive technique where hackers forge the "From" address on an email to make it appear as if it's coming from a trustworthy source, like your business. The intention behind email spoofing is often malicious, with attackers seeking to deceive recipients into clicking on links, downloading malware, or providing confidential information.

3. Enhanced Email Deliverability: DMARC ensures that your legitimate emails reach their intended recipients' inboxes. This reduces the chances of your emails being flagged as spam or not being delivered at all. Most spam filtering software is looking for failures of SPF, DKIM or DMARC records now. However, most people DO NOT have DMARC setup properly. How do I know if I have it: Use a free tool like MXToolBox's DMARC tool and enter your domain. If you see a bunch of red x’s instead of green check marks, chances are it’s either not setup, or it’s setup incorrectly. Remember – DMARC is free to setup and if you have an IT company they should be able to help you configure this if you are unable to.

Setting Up DMARC

To set up DMARC for your business, you'll need to create a DMARC record within the Domain Name System (DNS). This configuration can be performed through your domain provider, such as GoDaddy, BlueHost, or other popular service providers. Your domain typically takes the form of an email address like [email protected] or a website address like www.mybusinesswebsiteisadomain.com. You should be able to access the "Manage DNS records" option within your provider's settings.

1. Identify Your Domain: First, identify the domain for which you want to set up DMARC. This is typically your company's primary domain. You will need to navigate to the "Manage DNS Records" option within your provider's settings.

2. Create a DMARC Record: Next we will want to “Add a Record” Your DMARC record is a DNS TXT record, and it includes various tags that specify how you want to handle email authentication failures. This is an example of what a record should look like:

Example DNS DMARC Record

The value key tags detail how DMARC handles the settings, for the bare minimum users should use these three (If you wish to add higher levels of security & learn more about other tags like fo & pct as seen in the above example, please visit: https://mxtoolbox.com/dmarc/details/dmarc-tags)

• Version (v): This tag specifies the DMARC protocol version. Use "v=DMARC1" to indicate DMARC version 1.0.

• Policy (p): This tag defines the policy for email authentication failures. You can set it to "p=none" (monitoring mode), "p=quarantine" (emails failing authentication are placed in the recipient's spam folder), or "p=reject" (emails failing authentication are rejected). Reject is the strongest option. Important! If you’re new to setting up a DMARC policy, we strongly recommend starting with a policy of p=none; and sp=none; to allow for familiarization with the overall process. This will give you time to read through and understand the reports. From here you will determine if you need to go with more restrictive settings, think of "none" as the monitoring only option. This will prevent large email delivery errors by avoiding quarantining or rejecting of legitimately sent email. If you are experiencing spoofing, a higher level of security may be required, but you should consult your security / IT professionals first.

• RUA/RUF Report Email Address(s) (rua)(ruf): These optional tag are designed for reporting URI(s) for aggregate data and Forensic Reporting. This tag defines the email address where DMARC reports should be sent. A rua example is rua=mailto:[email protected]. A ruf example is ruf=mailto:[email protected].

• Failure Reporting Options (fo): The FO tag pertains to how forensic reports are created and presented to DMARC users. A "fo" value of 1 means that forensic reports should be generated for each failed authentication event and sent to the email address specified in the "ruf"

• Percentage (pct): This DMARC tag specifies the percentage of email messages subjected to filtering. For example, pct=25 means a quarter of your company’s emails will be filtered by the recipient, pct=100 means all of your company’s emails will be filtered by the recipient.

3. Publish the DMARC Record: Once you've created the DMARC record, save it to your DNS settings. This allows email receivers to check the DMARC policy for your domain.

Setting up DMARC is not only effective but also free if you own a domain. To bolster your email security, it's also advisable to set up SPF and DKIM keys. Your domain provider should have comprehensive guides or support to help you set these up.

Verifying Your DMARC Implementation

After setting up your DMARC record, you'll want to verify that it's working correctly. You can use the free DMARC tool provided by MXToolBox for this purpose. Here's how to do it:

1. Visit MXToolBox: mxtoolbox.com/DMARC.aspx.

2. Enter Your Domain: Enter your domain name into the tool. I.E - mydomain.com

3. Analyze the Results: The tool will provide you with a detailed analysis of your DMARC record, including whether it's correctly configured and any potential issues that need to be addressed. Generally, all green check marks mean your DMARC passes, and all red x’s mean it failed. If it failed, you should go back and look at your configuration. Remember, each value key tag should be spaced out and ended with a semi colon (;) Feel free to copy the below text with our preferred settings (Be sure to update the email addresses)

v=DMARC1; p=none; sp=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1; pct=100; aspf=r; adkim=r;