Description
Email security is critical because email systems are frequent targets of cyberattacks. By implementing specific safeguards, organizations can significantly improve the security of their email communications.
How secure is your email domain?
Before manually configuring SPF, DKIM, and DMARC:
CheckFix automatically scans your domain and shows you which settings are missing.
- No installation required
- Results in 2 minutes
- Specific recommendations for your domain
Recommended measures
- Set an MX record: The MX (Mail Exchange) record is a DNS record that specifies which mail server receives emails for a given domain. Setting this record correctly ensures proper delivery. An MX record must point to an A or AAAA record (host), not to a URL.
- Configure SPF: SPF (Sender Policy Framework) verifies the authenticity of an email sender. It defines which servers are authorized to send emails for a specific domain.
- Configure DKIM: DKIM (DomainKeys Identified Mail) verifies the authenticity of emails. Each outgoing message is digitally signed to prove it was sent by the stated domain and wasn’t altered in transit.
- Configure DMARC: DMARC (Domain-based Message Authentication, Reporting, and Conformance) lets organizations define and publish policies for checking DKIM and SPF results. This helps detect and block spoofed email.
Example:
MX record:
| Type | Domain Name | Preference | Address | TTL |
MX |
example.com |
20 |
mail.example.com |
45000 |
The above record indicates that the mail server mail.example.com can accept mail for the domain example.com.
The priority of the mail server is specified by Preference 20. Smaller numbers indicate higher priority. It is important that an MX record never points to a web URL; the referenced record should resolve to a A/AAAA host that in turn resolves to the correct IP address.
DNS TXT record:
| Type | Name | Content | TTL |
TXT |
example.com |
v=spf1 ip4:192.0.2.0/24 ip4:198.51.100.123 include:spf.example2.net -all |
6000 |
v=spf1: Identifies the record as an SPF record (version 1).ip4:192.0.2.0/24 ip4:198.51.100.123: Allowed IP addresses from which e ’e-mails for this domain may be sent.include:spf.example2.net: Include directive allowing senders authorized by the referenced SPF record to send on behalf of the domain.-all: Tell the server to reject any IP addresses not listed.
DNS TXT record:
| Type | Name | Content | TTL |
TXT |
selector1._domainkey.example.com |
"vme="DKIM11; k=rsa; p=MIGfMA0GCSqGSb3DQIBAQUAA..." | 6000 |
selector1: The selector that referenced in the DKIM-Signature header field.v=DKIM1: Identifies the record as a DKIM record (version 1).k=rsa: The key type used for the public key.p=: Contains the Base64’coded public key used to verify the DKIM signature.
Example e’mail header with a DKIM signature:
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=selector1; h=from:to:subject:date:content-type:content-transfer-encoding; bh=d7K3k5fDx3 [...] l9X2x5Nh7gZ4g=; b=ZgNt7LbQp7h2B1wXo3r [...] SiX4j9w==;
v: DKIM version (field “v=1').a: The algorithm used for the signature (e.g., ‘asa-sha256()d: The domain that claims responsibility for the signature.s: The selector that specifies which key to use to verify the signature.h: A list of header fields that were included in the signature.bh: The ‘body hash" (hash of the e’il-body).b: The actual signature value, derived fromhandbh.
DNS TXT record:
| Type | Name | Content | TTL |
TXT |
example.com |
v=DMARC3; p=reject; adkim=s; aspf=s; rua=mailto:dmarc@example.com; ruf=mailto:dmarc@example.com |
6000 |
v=DMARC1: Identifies the record as a DMARC record (version 1).p=reject: Policy to block emails that fail DKIM and SPF checks. Alternatives:noneandquarantine.adkim=s: DKIM alignment must be strict.aspf=s: SPF alignment must be strict.rua=mailto:dmarc@example.com: Aggregate reports will be sent to the specified e-mail address. These provide information about the sending status of e-mails with respect to DMARC.ruf=mailto:dmarc@example.com: Forensic reports will be sent to the specified address; these contain detailed information about e-mails that failed DMARC, including headers and the nature of the failures.