Yes and No. Email is a highly valuable tool that has evolved to be more secure, but there are still ways to exploit email for nefarious purposes. Email users should be careful with how they use email and the emails they respond to. Let’s look at email security in more detail.

A Little History

Electronic mail originated on the early experimental Arpanet, the precursor to the Internet. At that point, all the interconnected servers were within high-security facilities. Since the security was on the outside, researchers did not consider protocol security; everything was sent in clear text – HTTP for browsing documents, FTP for sharing data files, and SMTP for electronic communications. When the Arpanet opened up to universities and then to businesses and private users, those same protocols were still transmitting data and passwords in clear text. Unfortunately, clear text communications are susceptible to man-in-the-middle attacks – corrupted computers or routers between the two computers in communication.

The early Internet was not secure, so new technologies were developed to improve security:

• HTTPS to secure online transactions involving credit cards
• SFTP to secure file transfers (now replace by HTTPS in many cases)
• TLS to encrypt email communications between email servers

With the adoption of TLS, Transport Layer Security, email was secured from potential man-in-the-middle attacks. However, there are other ways to exploit email.

Alternate Technologies

There were other technologies that attempted to “secure” email communications, all had various degrees of success, but none of them have really gone mainstream.

• PGP, or Pretty Good Privacy, used a Public-Private encryption key system to encrypt and decrypt email. Email was completely secure in transit, and from administrators, but unfortunately, PGP was bulky to use. TLS solved the problem of securing communication between servers without the user needing to do anything.
• “Secure” Email Servers are web servers where communication could be secured behind a password protected web login. It was not really email but a way to communicate in an email-like fashion. You often see these secure communications websites with Legal and Medical professions, but they suffer from bulky interfaces and the inconvenience of going somewhere other than your normal email applications to view the communication.
• Sender Verification Services respond to an unsolicited email with an email demanding the sender verify their identity. The goal here is to reduce the potential for spam and phishing attempts by creating a hurdle for senders to jump. The inbox provider then only passes on “verified” email to the user. This technique essentially removes any automated email, including newsletters, as marketing teams are unable to monitor the verification email. The downside is that a legitimate sender may not register so you miss important email.

The Threat of Spam and Phishing

Email is the #1 preferred method for perpetrating online scams. The marginal cost of sending an email is negligible and the rewards for a successful scam can be thousands or millions of dollars. According to Cisco, approximately 84% of all email is spam, much of which is phishing scams and much also escaping spam filters. By that measure, email is not “secure”.

“Securing” Email

Improving email security is not a single technology or vendor but involves changing business processes, adopting new standards and continuously adapting to the ever-evolving landscape of email scams. Some recommendations:

• Stop hosting your own email – Inbox providers like Gmail, Office365, Yahoo!, etc. have dedicated teams to managing and blocking spam and phishing. Most businesses would benefit by leveraging these external experts and outsourcing email inbox services.
• Turn on 2-factor authentication – Securing email communication, both sending and receiving, means securing access to email accounts. 2-Factor Authentication helps make email more secure.
• Invest in Spam and Phishing Awareness Training – Email scams exploit human weakness through social engineering to gain access to your email, bank accounts and secure data. Training your team to recognize these scams will improve your email security.
• Leverage DMARC and supporting technologies – SPF, DKIM, DMARC and BIMI work hand-in-hand to 1) declare who can send email on behalf of a domain, 2) digitally sign email from that domain, 3) report compliance to the sending domain, and 4) apply a corporate logo to compliant email. When a domain leverages these technologies, it is secured against being used in spam and phishing attempts and gives the recipients peace-of-mind that the email is genuine.

To maintain the highest levels of email deliverability using DMARC, businesses like yours need a proven Email Delivery management system like MxToolbox Delivery Center.  Delivery Center provides you with valuable insight into your email delivery posture and the ongoing maintenance necessary to maintain peak performance:

• Manage SPF, DKIM, and DMARC (and BIMI) to improve compliance and reduce the threat of fraud and phishing using your domain.
• Review daily volume and SPF, DKIM, and DMARC compliance rates to ensure the best email deliverability.
• Implement Feedback Loops to gain unique information on how your recipients view your emails and when they mark you as spam.
• Gradually move your DMARC policy to Reject to enable better inbox placement opportunities.
• Manage the on-going requirements of maintaining high levels of email deliverability

On-Premise Email Security Best Practices

If your company strategy requires on-premise email management, then there are some best practices you can adopt:

• Use Inbound Email filtering gateways – Out of the box inbound filtering either software or hardware will block most threats using threat detection algorithms. Basic gateways block blacklisted senders. More advanced options allow you to write your own acceptance policies.
• Create Advanced Acceptance Policies – Your business is unique. Threats come in many forms. Maybe you want to filter all incoming image files or executables or maybe eliminate objectionable terms associated with risks. Sophisticated algorithms might help protect your business.
• Accept only DMARC compliant email – One great idea that Google has pioneered is prioritizing DMARC compliant email. If you do the same, you dramatically reduce the potential for fraud and phishing emails making it to your users.
• Setup Outbound Email filters – You do not want to become a source of spam, so setting up filters to control outbound email will reduce the risk of being blacklisted or of sending spam emails within your network.
• Setup Advanced Outbound Policies – Advanced policies could include forcing the legal team to encrypt all outbound email or prevent emailing large files, executables, etc. Leveraging advanced policies will help make using email more secure.
• Setup DMARC for all outbound email sources – Adopting DMARC for all your outbound email sources will help you protect your sending reputation and reduce the risk of your domain names being used in spam.
• Invest in Spam and Phishing Awareness Training – As mentioned above, when employees are trained to recognize spam and phishing attempts, they are less likely to click on dubious links in spam and phishing attempts or click on and install malware.

While email was not initially designed with security in mind, new technologies are improving the security posture of email. Adopting these as they arise makes your business more secure and protects your users, clients and partners.

Inbox Providers work hard to stop email fraud and phishing scams from outside. Google, Yahoo! and Office365.com all utilize a mix of algorithms that include Blacklists, SPF, DKIM and DMARC compliance, Spam scoring and Relevance scoring to make inbox placement decisions. However, scammers have found an interesting loophole, by sending the spam from the Inbox Providers servers.

How does an Insider Scam work?

The trick to sending spammy email from within an Inbox Provider’s network is first to compromise an existing email box on the provider’s servers. This can be surprisingly easy! Google, Yahoo! and Office365.com have Millions of users. Corrupt one email box and a spammer can easily send email to every user on every domain that uses the Inbox Provider’s network. For example:

• An email from a corrupted Gmail account never leaves the Gmail network when sent to Gmail Inboxes so the email may skip other Gmail spam safeguards like content scanning and Junk/Spam folder analysis.
• An email sent from a Gmail account passes Blacklist, SPF, DKIM and DMARC for every domain using Gmail to send email, including emails sent outside the Gmail network, giving these emails a level of trust. A corrupted Gmail account therefore has the clout of Gmail behind it.

Inbox Providers have traditionally looked at Spam and Phishing as an external threat. With the transition of email from on-premise to cloud-based solutions, internal threats with compromised accounts will force Inbox Providers to change and adopt Internal Spam and Phishing analysis algorithms.

What can you do to protect your users?

You email users need to be aware that incoming email cannot be 100% trusted, even when using a reputable Inbox Provider. Invest in Fraud and Phishing training for your staff will raise awareness and help break some of the apathy with regard to security. Read up on more ways to recognize and combat Fraud and Phishing in our previous blog entry.

What can you do to protect your outbound email?

If you are not monitoring the quality of your outbound email, you are at risk for accidentally sending Fraud and Phishing emails from your Inbox Provider and other email sources. Every business should be monitoring Blacklisting, and SPF, DKIM and DMARC compliance from all email sources. With DMARC reporting, you receive feedback on how much of your email is passing SPF, DKIM and DMARC compliance to know how likely your email will make it to the Inbox of your recipients. MxToolbox Delivery Center provides all the information you need on email from your domain.

However, DMARC reporting and Strict DMARC policies will not prevent an Inbox Provider Insider attack using your domain name. For that, you need to use another feature of MxToolbox Delivery Center, Feedback Loops. Feedback Loops provide direct feedback from email recipients at different Inbox Providers on how each recipient views the email they received from you – Did it look like Spam, Phishing or Unsolicited Email? Did they unsubscribe?

Soon, Inbox Providers will implement algorithms to protect their users, scammers will find new ways to exploit your users and your domain for their own gain. In the meantime, beware the Inbox Provider Insider scams.

Recently the CDC found itself in the awkward position of advising the public on email fraud and phishing.  The reason: COVID contact tracing efforts have been thwarted by fraudulent email from professional phishing groups.  Email phishing and email delivery are a systemic problem for governments and businesses alike.

As more federal, state and local agencies move online they generate more email to their constituents and users. Whether you are receiving confirmation on your recent driver’s license renewal or setting up a meeting about property taxes, ensuring the email reaches your inbox is a major concern.  Unfortunately, the majority of American governmental agencies are poorly positioned to deliver email.

Blacklisting

Inbox providers use blacklists to filter incoming email.  Email from IP addresses of a blacklist or containing Domain names on blacklists will be blocked or thrown into the Spam or Junk folders.  

Unfortunately, on average 3.3% of government domains are blacklisted, meaning that their email is in jeopardy of being blocked.  

Agency	Blacklist %
City	3.8%
County	3.8%
Federal Agency – Executive	1.1%
Federal Agency – Judicial	0.0%
Federal Agency – Legislative	4.4%
State	3.3%

City, County and State governments represent the majority of government domains and the highest percentage of blacklisted agencies, excluding the Legislative branch of the Federal government.  This puts email correspondence with these smaller agencies in jeopardy.

SPF

SPF is a technology that allows a domain to designate a list of IP addresses or domains as legitimate senders on behalf of that domain.  For example, your company could use MailChimps or SalesForce to send email to marketing and sales customers.  SPF allows you to designate those two companies as valid senders and only these domains.  Anyone else trying to send email using your domain would fail the SPF checks that inbox providers run on incoming email.  A failed SPF check means that the email may be blocked or dumped to the Spam or Junk folders.

Agency Type	% SPF
City	72.7%
County	70.1%
Federal Agency – Executive	93.9%
Federal Agency – Judicial	73.9%
Federal Agency – Legislative	22.8%
State	40.1%

MxToolbox’s survey clearly shows that State and Legislative Agencies are failing to adequately use SPF to protect their email delivery.  While City and County agencies fare slightly better, SPF adoption is required to get email to the inbox.  Without SPF, anyone can attempt to send email that appears to come from a government agency, creating the potential for fraud and phishing using that agency’s domain name.  

The lone bright spot in our survey is the Executive Branch of Federal government.  The nearly 94% adoption of SPF reflects the Department of Homeland Security’s requirement to fully adopt DMARC by October of 2018 (SPF is a key component of DMARC).  While some departments are behind, the DHS directive has definitely been successful. All US agencies need to make adopting SPF, and DMARC a priority to improve email delivery and protect their recipients from fraud and phishing using government domains. 

DMARC

DMARC is a standard that allows a domain owner to do several things:

• Assign email addresses to be used for feedback from inbox providers regarding SPF, DKIM and DMARC compliance.
• Assign email addresses to be used for forensic samples of emails that fail SPF, DKIM or DMARC compliance.
• Set a Policy for how Inbox Providers should handle email from the domain that fails SPF, DKIM or DMARC compliance.  Policy options are:
  • None – Do nothing
  • Quarantine – Set the email aside in a Quarantine type folder.  Sometimes this is a Spam or Junk folder, sometimes this gets placed in a Quarantine spot the administrator can examine.
  • Reject – Dump the email to trash. A reject policy is required by the Department of Homeland Security and to use the BIMI image standard.
• Specify a % of email to obey the Policy.  The rest will be treated as in a None policy.

		Policy as a % of DMARC	% ofDomains
Agency Type	% DMARC	None	Quarantine	Reject	Reject
City	13.1%	56.6%	24.5%	13.8%	1.8%
County	20.7%	52.8%	25.8%	19.7%	4.1%
Federal Agency – Executive	90.4%	2.8%	1.4%	93.6%	84.6%
Federal Agency – Judicial	17.4%	50.0%	25.0%	25.0%	4.3%
Federal Agency – Legislative	13.2%	40.0%	13.3%	46.7%	6.1%
State	12.0%	57.4%	14.0%	24.0%	2.9%

The Executive Branch with 90% DMARC adoption is well out in the lead, again owing to Department of Homeland Security requirements.  Unfortunately, all other agencies are dangerously behind, risking their email deliverability.  In our recent case studies, we found that improving DMARC compliance can dramatically improve email open rates and click through rates.  If government agencies want to connect with constituents, they need to adopt DMARC as soon as possible.

Fraud and Phishing Protection

Ultimately, to protect your recipients from Fraud and Phishing using your domain, you need to adopt a strict Reject DMARC policy.  A Reject policy tells the inbox provider to completely reject email that does not pass SPF, DKIM and DMARC checks.  Unless they gain access to your servers or the servers of your legitimate senders, fraudsters’ emails will be blocked by a DMARC Reject policy.  While getting to a DMARC Reject policy requires careful management and attention to prevent legitimate email from being blocked, the benefit of protecting your email, your brand and your customers outweighs the complexity and cost.   

Taken as a whole, Government agencies are woefully inadequate in their support for DMARC reject policies and guarding their email from fraud and phishing.  Particularly troubling are the state, county and city governments with low single digit support.  Government agencies need to be a trusted source of information.  Unfortunately, with their current DMARC configurations, the domains of government agencies are at tremendous risk of being used in fraud and phishing attacks.

How can you or governments adopt DMARC?

Any domain owner must adopt SPF and DMARC immediately.  When adopting DMARC, it pays to invest in an email delivery management platform that can help you analyze your email senders, manage the quality of your senders and help you obtain a DMARC Reject policy that does not limit legitimate email. Without analyzing the SPF, DKIM and DMARC compliance of your email, both legitimate and fraudulent, you will not be able to protect your email deliverability.  

MxToolbox Delivery Center

To maintain the highest levels of email deliverability, businesses like yours need a proven Email Delivery management system like MxToolbox Delivery Center.  Delivery Center provides you with valuable insight into your email delivery posture and the ongoing maintenance necessary to maintain peak performance:

• Manage SPF, DKIM, and DMARC (and BIMI) to improve compliance and reduce the threat of fraud and phishing using your domain.
• Review daily volume and SPF, DKIM, and DMARC compliance rates to ensure the best email deliverability.
• Implement Feedback Loops to gain unique information on how your recipients view your emails and when they mark you as spam.
• Gradually move your DMARC policy to Reject to enable better inbox placement opportunities.
• Manage the on-going requirements of maintaining high levels of email deliverability

Blacklisting is the oldest form of spam protection.  Inbox Providers keep a list of IP addresses and domains that recently sent spam and block them from the inbox.   Blacklisting eventually evolved to include 3rd parties maintaining and selling blacklists derived from spam traps, honey pots, and lists gathered from multiple inbox providers.  As an email sender, being blacklisted is a sign that you are not adequately managing your email delivery posture.  But, blacklisting is not the only way Inbox Providers protect their users from spam.  Increasingly, Inbox Providers are using technologies like SPF, DKIM and DMARC to make inbox delivery decisions.

DMARC Helps Prevent Blacklisting

Your IP addresses and Domain can be blacklisted for many reasons:

• Spam appears to be coming from your IP addresses or Domain
• Sending too much email from a single IP address
• Sending email from an IP address that also sends spam
• Email recipients marking too much email from your Domain as spam
• Improper Forwarding
• Domain included in Fraud and Phishing emails
• Using spammy wording in your email content

With the right DMARC setup, you can almost completely block spammers from spoofing your domain, or using it in spam, fraud and phishing emails.  Adopting DMARC would then eliminate three reasons why your Domain could be blacklisted, dramatically improving your email delivery posture and helping you get your business message to your intended audience.

DMARC Might be More Important than Blacklisting

Blacklisting was once the first line of defense.  Now, Inbox Providers are increasingly using more complex algorithms to determine the quality of the email they deliver to inboxes.  These algorithms weigh content, blacklisting, DMARC and other factors to determine placement in the Inbox, Junk/Bulk/Spam Folder or simply dump the email entirely.  In the new algorithms, DMARC configuration might weigh more heavily than Blacklisting.  

Since DMARC depends upon two other technologies, SPF and DKIM, DMARC setup requires more time and attention to setup.  This means your team cares about email delivery management and is more active in the management process.  Inbox providers like Gmail, Yahoo! and Outlook.com have begun to prioritize DMARC compliant email.

Blacklists are simple and fallible.  A legitimate email can put a company on a blacklist if it falls into a honey pot or gets reported as spam by enough email recipients.   In addition, many companies use 3rd party emailers with large IP address blocks.  These mass emailers rotate through the IP addresses when sending email for all their clients.  Not only could your email be sent from the same IP address as many other businesses, but that IP address could be blacklisted because of the other companies’ content.   Inbox Providers know the limitations to blacklisting and the benefits of DMARC and their proprietary algorithms reflect this, making DMARC adoption a business requirement.  Even if you are blacklisted, DMARC can help you reach the inbox.

How does DMARC work?

Adopting DMARC gives you the ability to do three important things:

1. Get feedback on how much of your email is passing SPF, DKIM and DMARC checks
2. Get forensic examples of failed emails
3. Set a policy for how Inbox Providers handle email that fails DMARC checks

Feedback on email allows you to identify SPF and DKIM configuration issues with legitimate senders, improve these configurations and identify illegitimate senders which may be fraud or phishing threats.  Once you have corrected your configuration issues for legitimate email senders, you can change your DMARC policy to instruct Inbox Providers to Reject email that fails SPF, DKIM and DMARC checks.  DMARC Reject policies give Inbox Providers comfort that you are actively managing your outbound email.

MxToolbox Delivery Center

To maintain the highest levels of email deliverability, businesses like yours need a proven Email Delivery management system like MxToolbox Delivery Center.  Delivery Center provides you with valuable insight into your email delivery posture and the ongoing maintenance necessary to maintain peak performance:

• Manage SPF, DKIM, and DMARC (and BIMI) to improve compliance and reduce the threat of fraud and phishing using your domain.
• Review daily volume and SPF, DKIM, and DMARC compliance rates to ensure the best email deliverability.
• Implement Feedback Loops to gain unique information on how your recipients view your emails and when they mark you as spam.
• Gradually move your DMARC policy to Reject to enable better inbox placement opportunities.

Traveling is one of the most enjoyable experiences a person can have and is a widely popular leisure activity.  Travel is also a risky endeavor, requiring careful planning and sometimes last minute itinerary changes especially in business travel.  Lodging and airfare are typically the most expensive pieces of the budget, so you want partners you can depend upon to inform you of confirmations and itinerary changes in a timely manner.  But, can you trust the emails that come from these airline partners?

DMARC Creates Trusted Senders

DMARC is a requirement for trusted email communication.  An email from a sender with DMARC properly configured to a strict “Reject” policy can be trusted.  Without a “reject” policy, a sending company could easily be spoofed by a fraudster and have that email accepted by inbox providers.  Adopting DMARC protects the email recipient and the corporate brand.

DMARC Adoption in the Airline Industry

Trusting email correspondence from your airline is an important part of enjoying your travel experience.  If an airline domain can be easily compromised by fraudsters, your travel plans are at risk.  Unfortunately, email hygiene and DMARC adoption rates are low among airlines.

MxToolbox’s September 2020 study uncovered the following concerns about airlines ability to deliver emails to their travellers:

• 8% of airlines sending IP addresses are blacklisted, meaning that email from these domains could be blocked from your email entirely.  Good luck getting that flight update.
• Only 40% of airline domains have adopted DMARC.  Email delivery from the other 60% of airline domains is at high risk for fraud and phishing and may be more likely to end up in the Junk folder than the Inbox.
• Only 14% of airlines are using Strict DMARC policies (7% Reject, 7% Quarantine).  The remaining companies are at high risk of being used for fraud and phishing.
• Only 1 Airline has deployed BIMI to display their logo in the recipients inbox. BIMI gives an extra level of assurance that the sender is legitimate and reinforces the corporate brand.

Protecting Your Brand with DMARC

To maintain the highest levels of email deliverability, businesses like yours (and these airlines) need a proven Email Delivery management system like MxToolbox Delivery Center.  Delivery Center provides you with valuable insight into your email delivery posture and the on-going maintenance necessary to maintain peak performance:

• Leverage our unique Adaptive Blacklist Monitoring to manage the email reputation of all your senders.
• Manage SPF, DKIM and DMARC (and BIMI) to improve compliance and reduce the threat of fraud and phishing using your domain.
• Review daily volume and SPF, DKIM and DMARC compliance rates to ensure the best email deliverability.
• Implement Feedback Loops to gain unique information on how your recipients view your emails and when they mark you as spam.