Posts Tagged ‘SPF’
Recently had a customer have a bounce back for an email someone tried to send him with the error
DNS Authentication – DMARC Fail
DMARC Utilises DKIM and SPF records to monitor senders and act accordingly. I checked the domain of the sender’s email using https://otalliance.org/resources/spf-dmarc-tools-record-validator and the domain had no DKIM or SPF but did have a DMARC Record!
You need to have SPF and DKIM records before DMARC
There’s been a new recent wave of spoof emails sent to companies , usually emailed to financial personnel’s pretending to be from the CEO to get quick funds paid and withdrawn.
Spoofing an email address isn’t hard and with the correct background check , spammers get the correct email and sometimes signature of the “CEO”.
How do we stop this?
- To start with SPF, DKIM, DMARC records should all be added to the domain to verify the sender to check they are allowed to send from the company domain
- You should definitely have an incoming spam filter before Microsoft Exchange , depending if this is a Barracudo box / Post fix / Microsoft Frontbridge you should be able to enable a Rule to SPF check for only your domain. Enabling this for all domains will starting to spam lots of incoming email due to people not having SPF records
- Create a quarantine in Exchaneg – From EMC > Organization Configuration > Hub Transport > Transport Rules create a new transport rule that says:
From users that are outside the organization
And when the from address matches text patterns yourdomain.com
Forward the message to email@example.com for moderation
Now, if you have other SMTP servers in or out of your org that send on behalf of your domain, you’ll need to create an exception by adding:
Except when the message header received matches text patterns smtp.yourdomain.com or smtp.theirdomain.com
You can forward these emails to : firstname.lastname@example.org or use the Outlook plugin to report and hopefully Microsoft should block these in future : https://www.microsoft.com/en-us/download/details.aspx?id=18275
Microsoft have actually now got a new filtering service for 365 however its paid for and by user you could maybe try : https://products.office.com/en-us/exchange/online-email-threat-protection
It’s not uncommon nowadays to have another third party appliance such as a barracuda or a hosted service such as post fix to filter items before they get to 365. It seems once a spammer figures out how to exploit 365 , all domains get the same spam. 2 layers of protection is safer!
1) Make sure your own SPF Records are in check : http://www.spfwizard.net/
2) Get your DKIM records in check : http://blogs.msdn.com/b/tzink/archive/2015/10/08/manually-hooking-up-dkim-signing-in-office-365.aspx
3) Get your DMARC Records in check : http://blogs.msdn.com/b/tzink/archive/2014/12/03/using-dmarc-in-office-365.aspx