Birth of the DMARC standard

After 18 months of collaboration, a number of Internet companies, including Yahoo, Microsoft, Bank of America, Agari, AOL, PayPal, Google, Cloudmark, etc., have come up with the DMARC or Domain-based Message Authentication, Reporting & Conformance standard. The main aim of all these players is to effectively combat spam by promoting genuine communication between sender and recipient. In the future, they intend to submit the DMARC protocol to the Internet Engineering Task Force so that it can become a standard in the field of IT security.

Purpose of the DMARC protocol

Nowadays, it’s easy to spoof an e-mail address to send illicit mail, since the recipient has no way of checking that the e-mail has actually come from someone he knows. In general, sensitive companies are the main victims of identity theft: banking establishments, tax centers, etc. The hackers’ objective is simple: to try and steal users’ passwords, logins and other personal data. The use of the DMARC protocol will enable all players to put an end to this practice.

How the DMARC standard works

Two solutions are currently used by Internet users to combat phishing and spamming : DomainKeys Identified Mail or DKIM and the Sender Policy Framework or SPF. With the first, the recipient will be able to analyze the cryptographic signature of the e-mail received to determine the domain name from which it was sent. Only e-mails from a secure e-mail address will be accepted. The second will enable owners to specify which hosts can use their domains to send e-mail.

Despite their effectiveness, DKIM and SPF solutions have a number of weaknesses. This is why the DMARC standard was created. Thanks to it, senders will be able to inform recipients so that the latter can better filter their e-mails. Since e-mails received from senders are always authenticated, recipients can block suspicious messages straight away. It’s an effective protection for users’ domain names.

The main advantages of the DMARC protocol

Using the DMARC protocol is advantageous because no spam or phishing will be able to invade the user’s domain name. When the filters in place, i.e. DKIM and/or SPF, detect an error in the signature of an e-mail, it can be immediately quarantined or permanently blocked. The main advantage of the DMARC standard is that the sender can receive reports on the percentages of authenticated and spam e-mails.

The DMARC protocol protects Internet users from fraudulent attempts to harvest their sensitive data. The most common type of fraud is the launch of fake websites imitating those of banks, online stores or tax authorities. When the e-mail lands on the recipient’s server, the DMARC protocol first seeks to authenticate the message before sending it back to the inbox. At present, several email providers, including Gmail and Yahoo, are adopting this feature.