One of the fundamental difficulties of securing email is caused by the fact that it was designed in an age before cyber security had been born. It was designed as an open protocol – without the ability to confirm a sender’s true identity. This flaw has led to an onslaught of phishing attacks – which often lead to further network compromise. Many studies show that phishing is the launch vehicle for anything from 80% – 95% of all cyber-attacks. The growing response by mainly large organisations is to turn DMARC. (Domain-based Message Authentication, Reporting, and Conformance), an open standard that can help prevent phishing attacks. In theory DMARC can be highly effective in this job, preventing domain type personation attacks. However, recent data shows that large numbers of companies are not successful at fully implementing DMARC.
Valimail analysed more than a million of the largest websites and found 70% who had implemented were not getting it right. Surprisingly this failure rate applied to companies whether they are large or small. In other words, even with the near infinite IT resources of the largest companies in the world, they did no better than a small-sized company when it came to properly implementing email authentication. At Egress, we have seen many well-known brand names domains incorrectly configured for DMARC, and thus it becomes very time consuming to check whether a domain is legitimate or in fact a fake.
Here’s why companies struggle:
DMARC Is Tricky to Implement
The first problem is that DMARC is based on two 10-year-old standards, SPF and DKIM. All three standards are based on DNS TXT records which is a great place to store domain-relevant information but furthest thing from a point and click environment you can imagine. There is no GUI, and the syntax is cryptic. One misplaced character can render it useless. DNS is so critical to the operation of an online business. Consequently, many organizations require a multi-week process before making any DNS record changes. Half a dozen DNS changes could easily take months to get through the pipeline.
DMARC Was Not Built for the Cloud Era
DMARC has built in limits that makes it challenging for companies that have or are embracing cloud services. For instance, Sender Policy Framework (SPF) – an open, DNS-based email authentication system – has a 10-domain lookup limit. This could run out if you have three of more cloud services sending on your behalf. If your company is using more than three cloud services that want to send email on your behalf, you need to list those cloud services’ mail servers by IP address. Do you know all the IP addresses used by Chimp Mail? How about Gmail? Are you prepared to update your DNS record every time one of those providers adds a new server? The reality is it does not get done.
No One Wants to Cut Off Critical Services Accidentally
Many companies lack the confidence that they’ve identified all the legitimate services that should be able to send email on their behalf. The consequences of an error can be high: Your IT Dept might never have heard about some of your contracted message services. Cutting off access to email could be disastrous for any work the firm has in progress. IT administrators know the risks, so they are reluctant to take DMARC all the way to enforcement mode until they are absolutely sure it’s not going to cut off any critical services. Given the problems with DMARC’s complexity and its built-in limitations, that state of absolute confidence may never arrive.
Configuration Is Just the First Step
Now, consider that the above three problems – all relate to configuration. Once your email authentication is configured correctly and set to enforcement mode, you will need to consider maintenance, management, and alerting/notification (dealing with warnings, alerts to spikes in phishing attacks). A lot of companies start with the best of intentions, not appreciating the complexity that comes with implementation. They then get into hot water and can’t get past the initial "monitoring mode" of DMARC without ever getting to enforcement, where DMARC’s greatest security and compliance benefits reside. It's an unfortunate reality that DMARC is simple in principle but complicated to manage in today's modern, cloud-centric world. The devil is in the details.
So what’s the answer?
My view is that DMARC a huge workload for IT staff, with lots of potential downsides in a business risk view, especially in accidentally cutting off services, and also giving staff the false impression that the email gateway is offering protection from all phishing. The reality is even when in enforcement mode, its protection is working against the less common domain spoofing attack, and doesn’t protect against the very popular name spoofing attack. The better way for cloud based email users is look for a Cloud Email Security Supplement (CESS) which is designed to detect advanced phishing attacks and can warn the user in real time.
