Why Your Company Could be Unprotected Due to Incorrect DMARC Implementation

A barrier is not very effective if you can just walk around it.

Ninety percent of security breaches start with a phishing email. The most effective type of phish — and the hardest to detect — is the email impersonation attack, where fraudsters use a false name email address to make it look like their message is coming from a legitimate sender, maybe even an executive within your company.

Instead of accepting this as a fact of our digital lives, however, there is a solution. Email providers around the globe have united around a new global standard, called DMARC (Domain-based Message Authentication, Reporting & Conformance), that can make email safe again.  

It’s all about getting to enforcement

Despite growing adoption of DMARC, many companies are lagging. Our research shows that 70-80 percent of the organizations that have published a DMARC record have failed to use it to authenticate their email, which means they’re missing out on its major benefits. Reasons vary, but adopting DMARC-based email authentication can be a technical challenge, a bandwidth issue, and requires ongoing management that can be a burden to IT.  

Many organizations that have tried to set up DMARC records have chosen to use it only as a reporting and analysis tool, deploying it in monitoring mode. This doesn’t go nearly far enough towards securing email. Monitoring mode might help you see the bad guys, but doesn’t help you stop them.  

To end email impersonation attacks and accrue the real benefits of DMARC for your organization, the goal has to be getting to a state of DMARC enforcement. Enforcement means authentication is turned on so you can make email safe again, stopping email impersonation attacks and controlling shadow email. Monitoring mode is simply not enough.

Three states of DMARC

There are three DMARC policies with vastly different ramifications for how suspicious email is handled.  We believe every company should adopt a strategy that moves them towards enforcement (p=quarantine or p=reject).

Table comparing different DMARC policies

Check your domain health

Want to find out if your email is safe?  Enter your domain name in our domain checker at valimail.com.  DMARC enforcement blocks the bad guys and puts you in control, and Valimail has helped many organizations end email impersonation attacks and protect their brand.  Feel free to contact us if we can help.

Top photo: A barrier isn't very effective if people can just walk around it. Photo credit: wuestenigel/Flickr via photopin