Test another domain

{{ domain }}
is vulnerable to email spoofing

{{ domain }}
is not vulnerable to email spoofing

Analysis

  • SPF
    • {{ domain }} has an SPF record.
    • {{ domain }} has no SPF record.
    • The SPF record for {{domain}} has a strong defensive configuration.
    • The SPF record for {{domain}} has a weak configuration.
    • Record: {{ message.spf.record}}
  • DMARC
    • {{ domain }} has a DMARC record.
    • {{ domain }} is a subdomain of {{message.dmarc.orgRecord.domain}}.
    • {{ message.dmarc.orgRecord.domain }} has a DMARC record.
    • {{ domain }} has no DMARC record.
    • The DMARC record for {{ domain }} is configured with a policy of {{message.dmarc.policy}}.
    • The DMARC record for {{domain}} is configured with a policy of none. A DMARC policy of none still delivers emails that fail SPF and DKIM alignment.
    • The DMARC record for {{domain}} is configured to send aggregate reports.
    • The DMARC record for {{domain}} is configured to send forensic reports.
    • The DMARC record for {{message.dmarc.orgRecord.domain}} is configured with a subdomain policy of none. A DMARC subdomain policy of none still delivers emails for subdomains that fail SPF and DKIM alignment.
    • The DMARC record for {{message.dmarc.orgRecord.domain}} is configured with a subdomain policy of {{message.dmarc.orgRecord.sp}}. A DMARC subdomain policy of message.dmarc.orgRecord.sp will prevent email spoofing from subdomains of {{message.dmarc.orgRecord.domain}}.
    • The DMARC record for {{message.dmarc.orgRecord.domain}} has no specified subdomain policy. Without one, the subdomain alignment configuration defaults to the basic DMARC policy.
    • The DMARC record for {{ message.dmarc.orgRecord.domain }} is configured with a policy of {{message.dmarc.orgRecord.policy}}. A policy of {{message.dmarc.orgRecord.p}} will prevent email spoofing from {{domain}}.
    • The DMARC record for {{ message.dmarc.orgRecord.domain }} is configured with a policy of {{message.dmarc.orgRecord.policy}}. A policy of {{message.dmarc.orgRecord.p}} still delivers emails for subdomains that fail SPF and DKIM alignment.
    • Record: {{ message.dmarc.record }}
    • Organizational Record: {{ message.dmarc.orgRecord.record }}

Recommendations

To avoid the risk of email spoofing from {{domain}}, Bishop Fox recommends the following:

  • Begin implementing an SPF record for {{domain}}. SPF records are DNS TXT records on the root {{domain}} domain that define all of the IP addresses permitted to send emails from {{domain}}. Additional information on setting up SPF records can be found at the OpenSPF project's SPF Record Syntax page.
  • Modify the SPF record for {{domain}} to contain a reject all mechanism.This is performed by adding the string -all or ~all to the SPF record for {{domain}}. Additional information on setting up SPF records can be found at the OpenSPF project's SPF Record Syntax page.
  • Begin implementing a DMARC record for {{domain}}. DMARC records are DNS TXT records, located at the _dmarc.{{domain}} subdomain, that instruct receiving mail servers how to handle emails that fail SPF and DKIM alignment. For DMARC to function, {{domain}} needs to have both SPF and DKIM configured. Additional information about setting up DMARC records can be found from the Google Apps DMARC setup guide.
  • A DMARC policy of none allows spoofed emails to be delivered. Begin implementing a DMARC policy of quarantine or reject. As implementing strict DMARC policies may interfere with the delivery of email from {{domain}} email addresses, Bishop Fox recommends setting up and monitoring aggregate report notifications for legitimate emails before beginning to implement a stricter policy. If no legitimate emails are reported, set the DMARC policy to quarantine and set the pct field to a low percentage. This process is described in more detail in the Google Apps DMARC setup guide.
  • A DMARC subdomain policy of none allows spoofed emails from subdomains to be delivered. Begin implementing a DMARC subdomain policy of quarantine or reject, or remove the subdomain policy and implement a DMARC policy of quarantine or reject. As implementing strict DMARC policies may interfere with the delivery of email from {{message.dmarc.orgRecord.domain}} email addresses, Bishop Fox recommends setting up and monitoring aggregate report notifications for legitimate emails before beginning to implement a stricter policy. If no legitimate emails are reported, set the DMARC policy to quarantine and set the pct field to a low percentage. This process is described in more detail in the Google Apps DMARC setup guide.

To manage the risk of email spoofing from domains other than {{domain}}, Bishop Fox recommends the following:

  • Configure the {{domain}} email server to quarantine emails that fail SPF alignment on the From field. Nearly 41% of the Alexa top million domains are configured with SPF records, but only 1.8% of those domains are configured with a strict DMARC record.