Sender Policy Framework

Third, and the big one, three records that you need to make sure are in place.

SPF, DKIM, and DMARC.

These three records decide whether your mail arrives.

Taught with one simple explanation, no fear.

Let's take a look at all three in one simplified explanation.

Think of every email your domain sends as a courier arriving at a receiving mail room.

SPF, the Sender Policy Framework, is the approved courier list you publish.

a record in your DNS naming the servers authorized to carry mail from your domain to another.

And there's a very technical underbelly on sending email.

There's something called DMARC, something called DKIM, and something called SPF.

If you don't have those set up right, there's even a fourth one where you can have like a little authorized, you got to pay like a thousand bucks for it.

There's ways to get it cheaper, but you have a little logo of your like logo that appears in the bar, there's things like that that you have to have just fundamentally just to have a chance to get in the inbox.

Absolutely.

I think one of the things that I always look at, regardless of a company, is I look at their email posture and looking at the public records in DNS, you can actually see what people have set up for email security, like their DMARC status, their DKIN cues, their SPF.

If you can look at that and say, okay, Where are they at? You can usually pretty well tell where they stand security-wise in that world.

Because if they don't have a DMARC record, for example, that means they have done absolutely zero with their email security.

yeah

um but also speaking of your admin access and what to do with it it's really important to implement and maintain strong email security protections And this isn't where I'm talking about forced TLS settings, but your SPF.

I know I'm about to pepper you with acronyms, but the SPF DKIM and DMARC settings, which basically are showing what's a legitimate SPF.

sender for, for your organization, um, and setting up rules for anything that's not verified through these different protocols to be quarantined or rejected by someone who receives it.

So if there is spoofing of your practices, email that helps protect, um, recipients of that if it wasn't actually sent from your organization's email.

And that check leans on the authentication records underneath.

SPF, DKIM, and DMARC.

When those records are published and correct, the verdict is clear.

When they're missing or sloppy, Defender has to guess.

Impersonation checks only work well when Defender can trust the authentication records behind each domain.

And those records live in DNS, one level under all of this.

SPF, DKIM, DMARC, the layer, under the layer.

Every impersonation check starts with one question.