Two things are going to happen to you if you don't take action:
Your emails will start to go into junk folders
Irrespective of whether you've emailed that person for the last ten years, this will start to happen
That's all emails from your domain, most importantly invoices, which won't get noticed and/or paid if they start going to junk
2. Your domain could be spoofed by hackers
Ie copied, where hackers would have the ability to legitimately use your domain
This could then be used to mount attacks against your customers and suppliers impersonating your organisation
On the topic of invoices, hackers could send invoices out with amended banking details so your customers pay into their bank instead of your own
The reason that these two things will happen are because of the upcoming changes around DMARC.
What changes have and will happened?
Google has announced that from February 2024, it will require email authentication to be in place for all senders when sending emails. Yahoo and Apple have also taken the same stance with Microsoft likely to join them soon. They are doing this for good reason, it’s to make it harder for hackers to impersonate email domains.
More than 90% of successful cyberattacks start with a phishing email
So, it will be a requirement to have certain standards for email authentication for email to flow seamlessly from any organisations domain into the desired inbox when they send an email.
There are three main types of email authentication methods that have been put in place to try to prevent unauthorised parties from sending emails on behalf of a domain they do not own. They are:
Sender Policy Framework (SPF)
SPF is a way for a domain or set of domains to list all the servers they send emails from
Domain Keys Identified Mail (DKIM)
DKIM is a digital signature that uses cryptography to mathematically verify that an email came from the domain that it says it does, as proof of legitimacy
Domain-based Message Authentication, Reporting and Conformance (DMARC)
DMARC tells mail servers what to do when there's a failure or concern relating to of either DKIM or SPF of an email/domain/sender
Failure often means that one of the following will happen to an email
Marked as spam and placed into junk
Still delivered regardless depending on the failure
Rejected altogether
What is DMARC?
DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. It is an email authentication protocol that helps prevent email spoofing and phishing attacks by verifying that the sender's domain is legitimate. It is the standard that all organisations need to comply with to have seamlessly email flow from their domain.
What can we do?
There's two things every organisation needs to do:
1 - Test their domain
EquiTech Group can help with this. We have some tools we can utilise to test your domain and score it for compliance with DMARC standards.
2 - Remediation
Once step one is complete, we'll know if any remediation is needed and if so what. For some this can be a minor journey for others, there's lots of work to be done
What if we do nothing?
If you do nothing then your emails will start to go to junk folders or not be delivered, or the worst could happen. Your domain could be spoofed by a hacker to mount attacks on your customers or suppliers, or stakeholders that interact with you. This would all be under the guise of your legitimate domain, which is terrifying to say the least.
But not just this, they could mount an impersonation attack on your staff. They could:
Spoof your domain and impersonate a key individual, that could be a director, manager, finance personnel
The email sender and information would look completely legitimate
They could be using the legitimate email address, name, signature everything
Then the hacker could mount a more harrowing/sophisticated attack
Asking for a transfer of funds
Request to share sensitive information
Demand actions to compromise security further such as "Can you install this malicious software (ransomware)"
Take the latter. If an email of this nature was sent impersonating a director, to a new member of staff who is more junior, would they fall for it? Chances are they would.
Call to Action
Many organisations don't have a lot of time to act on this. If you'd like to assess your domain score in line with DMARC standards, or look at remediation steps to become compliant then speak to one of our consultants at EquiTech Group:
Phone - 01604 346 444
Email - info@etg365.co.uk
Opmerkingen