The History of Email Authentication

Email—despite its importance, ubiquity, and staying power—has never been secure.

Prior attempts at security have failed to solve email’s fundamental flaw—anyone can send email using someone else’s identity. This flaw has put the power of the world’s most admired brands in the hands of cybercriminals. Through email, criminals can use almost any brand or email domain to send spam, phishing emails, and malware installs, inflicting direct losses to customers and eroding the brand equity companies have spent years building.

Many of the most respected brands in the world, including Facebook, Apple, JPMorgan Chase, and PayPal have adopted DMARC to protect their customers and their brand.

Using DMARC, companies gain unprecedented visibility into legitimate and fraudulent mail sent using their domain names. The magic of DMARC is the ability to understand all the different mail streams being sent claiming to be from you—third parties, business units, and threat actors. The overall impact to companies that have adopted DMARC is preservation of brand equity, elimination of customer support costs related to email fraud, and renewed trust and engagement in the company’s email channel.

DMARC—an open standard enabled on 70% of the world’s inboxes—is the only solution that enables Internet-scale email protection and prevents fraudulent use of legitimate brands for email cyberattacks.

Introduction to the Basics
What Is DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an open email standard published in 2012 by the industry consortium DMARC.org to protect the email channel. DMARC extends previously established authentication standards for email and is the only way for email senders to tell email receivers that the emails they are sending are truly from them. DMARC allows companies that send email to:

• Authenticate all legitimate email messages and sources for their email-sending domains, including messages sent from your own infrastructure as well as those sent by third parties.
• Publish an explicit policy that instructs mailbox providers what to do with email messages that are provably inauthentic. These messages can either be sent to a junk folder or rejected outright, protecting unsuspecting recipients from exposure to attacks.
• Gain intelligence on their email streams by letting them know who is sending mail from their domains. This data helps companies to not only identify threats against their customers, but also to discover legitimate senders that they may not even be aware of.

What is a DMARC Enforcement Policy?

When you set a DMARC policy for your organization, you as an email sender are indicating that your messages are protected. The policy tells a receiver what to do if one of the authentication methods in DMARC passes or fails.

How it Works
When emails are received by the mailbox provider, the receiver checks if DMARC has been activated for your domain.