https://www.sikich.com

How to use Office 365 to Protect Your Organization from Email Spoofing

Sikich

Jul 11 2017

4 min read

Spoofing is a common challenge that organizations face in today’s world. Spoofing can lead to increased spam and more intensified phishing campaigns leading into malware and crypto-ransomware attacks. To reduce spoofing and provide a safer client experience, multiple technologies are available to reduce and prevent email spoofing, such as Office 365.

Office 365 already supports inbound validation of DomainKeys Identified Mail (DKIM) and Domain-based Messaging and Reporting Compliance (DMARC) mail. Both technologies check for trusted authenticated senders and help identify untrusted ones that that fail authentication. Sender Policy Framework (SPF) is a companion technology that helps prevent spoofing. SPF identifies which mail servers are allowed to send mail on your behalf. Basically, SPF, along with DKIM and DMARC, provide the best technological options to prevent email spoofing and phishing.

As a top Microsoft Office 365 partner in the United States, we have been able to help our clients use this technology to overcome this growing email challenge. It’s not uncommon to see the exact same issue in several organizations that reach out to us for help. Let’s breakdown these technologies that can help you protect your organization too.

Tools to Reduce and Prevent Email Spoofing and Phishing

Sender Policy Framework (SPF)

SPF permits organizations to specify which mail servers are permitted to send on their behalf. Every customer on Office 365 has added an SPF record as it is a required record to utilize the service.

DomainKeys Identified Mail (DKIM)

DKIM allows the organization owning the signing domain to claim some responsibility for a message by associating the domain with the message. Organizations that have enabled DKIM will allow senders to insert a digital signature into the message, which in turn is verified by the receiving party. DKIM allows senders to build domain reputation, which is important to ensure email delivery and provides senders a non-spoofable way to identify themselves. It is a critical component of email protection. Office 365 already performs DKIM checks on inbound email.

Domain-based Messaging and Reporting Compliance (DMARC)

DMARC, by its design, prevents email spoofing and helps stop phishing. Specifically, it protects the case where a phisher has spoofed the 5322.From email address, which is the email address displayed in mail clients like Outlook. Whereas the Sender Policy Framework (SPF) catches the case where the phisher spoofs the 5321.MailFrom, which is where bounce messages are directed, DMARC catches the case that is more deceptive. DMARC protects users by evaluating both SPF and DKIM and then determines if either domain matches the domain in the 5322.From address.

I know all these acronyms can get confusing. There might still be a swirl of questions circling in your mind. What does it mean? How does it work? Why should I care? At Sikich, we like to make life easier, so we’ve laid it all out for you in the summary below.

	SPF	DKIM	DMARC
What does it stands for?	Sender Policy Framework	DomainKeys Identified Mail	Domain-based Message Authentication, Reporting and Conformance
What is it?	A system to declare and verify who can send e-mails from a given domain.	An e-mail authentication system based on asymmetric cryptographic keys.	An e-mail authentication system that helps determining what to do when messages fail SPF or DKIM checks.
How does it work?	The receiving host checks if the sending host is allowed to send e-mails from the sender domain.	The sending host signs email body and/or headers with its private key. The receiving host verifies the signature, identifying if the fields are intact.	The receiving hosts applies the DKIM and SPF checks. Then it validates the results against the published DMARC policy and decides what to do: Block, quarantine, deliver, report to sender.
Why is it important?	It helps preventing spoofing and can prevent damage to your brand.	Greatly reduces the chances that your messages are treated as spam by digital signature.	Helps receiving organization decide what to do with e-mails that fails checks and create a feedback loop to allow course correction.

Have any questions about email spoofing prevention or Office 365? Please reach out to our experts at any time!

This publication contains general information only and Sikich is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or any other professional advice or services. This publication is not a substitute for such professional advice or services, nor should you use it as a basis for any decision, action or omission that may affect you or your business. Before making any decision, taking any action or omitting an action that may affect you or your business, you should consult a qualified professional advisor. In addition, this publication may contain certain content generated by an artificial intelligence (AI) language model. You acknowledge that Sikich shall not be responsible for any loss sustained by you or any person who relies on this publication.

About the Author

Sikich

From accounting, tax and assurance to technology and advisory, Sikich offers a unique formula of professional services to businesses and organizations across the country. By pairing subject matter expertise with the real-world experience gained as entrepreneurial leaders, we provide clarity to your complex challenges and solutions to strengthen every dimension of your business.