AXLR8 Resilience

DMARC, SPF and DKIM: What and Why?

Rick Marengo

The short answer is email security delivery and spam prevention which are related in many ways. Do not ignore these seemingly boring acronyms: DKIM and SPF. They help us assess whether we can trus emails.

What is the problem?

Opening every email is a risk. You need to trust emails you open. You need recipients to trust the ones you send.

One way to reduce that risk is to know who has sent it and assess whether or not we trust them. So how do we know who the sender is? Not by the sender name, that is for sure. Something purporting to come from a large trustworthy company, perhaps? Nat West bank or “SCREWFIX” (i.e. the tools and materials retailer) might mail you about your account or a competition. It may have come from from a different email domain if you click into it. SCREWFIX<dhlkjlj@zxyildgt .ru> is an example where you can see the “friendly name” “SCREWFIX” is completely different to the email domain name (the bit after the@-sign). See if you can spot this in the email below received as I looked for examples whilst writing this.

Spam Example with false "friendly name"
Spam example with false “friendly name”

So people send emails “spoofing” that they are someone else. Much spam is probably going out from your company name right now and causing damage to your reputation. This happens to every company after a while. So, how can we be even more sure of the sender?

How do you check a sender?

Where does this email come from?

Each server on the internet has a unique “IP” address to identify it. The IP address of the server where the mail originated provides a little more assurance. You can see the IP where an email originated (and all the servers it went through before getting to your email inbox by looking in the email “headers”. Different mail programs hide this in different places but you should be able to google where it is. It is a bit like the postmark on an envelope. If it says it was posted in Leeds, and your sender lives in Leeds, you can have a bit more confidence. If it says it comes from Santa Claus and the postmark says “North Pole” any grown up knows post marks can be forged. Regrettably, an IP can be spoofed in the same way. However, there are a couple of major problems even if the IP address of the sender is completely genuine. How do you know if it is the IP of the sender or just some other IP? The answer is SPF (Spam Protection Framework).

The SPF standard allows email domain owners to say: “Email from my domain may only come from the server with this IP address and any other IP addresses should not be trusted.” That is really helpful because even if you do not go comparing the IP address from which the email originated and the IP address(es) that the domain owner has configured, the mail relays will do so. It is relatively easy for them to compare the two and many will block mails that do not comply before you receive them. Now turn it around the other way. If you do not set this up for your email domain, more and more servers will block your emails and people will not receive them. I.e., you will have a “deliverability issue”.

To add your valid originating IPs for your company, you need to add the details to the “SPF record”. This is done in the DNS control panel for your domain. The task requires technical knowledge. Do not attempt DNS changes unless you understand how it all works. Call your ISP or hosting company to ask their advice. Also, you should make sure you (or a technical manager you trust) know the access credentials for the DNS for any domain in your business so you can make changes when required.

What, When and Who are valid for this email?

Experts soon saw that the above weaknesses in SPF needed to be addressed. A new method was needed. There had to be some way machines could trust an encrypted key mechanism to see if the email was genuinely:

  • sent at that date and time
  • from that email address (sender)
  • to that/those email addresses (recipients)
  • Subject line.

This is accomplished by DKIM (DomainKeys Identification Method) whch was designed to address the problem. You need to make sure you have this set up correctly for any servers you authorise to send your email. You need to make sure your incoming email servers check it, too.

The way it works is that the email server generates an encrypted string (2048 bit is acceptable at time of writing) which encodes the above facts as the email is sent. When any mail “relay” server receives it, it can check this against a 2048 bit DKIM key that is shown publicly on the domain. If the two “fit” together, the email is passed along. If not, some other action ranging from nothing to an alert to blocking (or even deleting) takes place. Because of the challenging rise in spam and dangerous emails, the servers and mail applications are getting increasingly strict.

Once again, to set this up, you need a DNS skilled professional. The whole process should be less than half-an-hour including checking with a tool like MXToolox.com or demarcian.com. It may seem expensive and complicated but “doing nothing” is will probably come with a cost! Your business emails will get blocked and become more and more undeliverable.

You may hear about another Acronym: DMARC. (Domain-based Message Authentication, Reporting and Conformance) This is a way that email management professinals configure their servers to react to the SPF and DKIM data associated with the emails. Basically, the rules as to whether it is fine, marked a spam or so dangerous it needs to e deleted. Different professinals take different views. However, the large organisations that move the most email traffic also getting stricter. So you need to be verified byut them also or your email will be rerouted or deleted if not properly configured to prove you are who you say you are.

Verification records

In addition to the above internationally accepted DMARC standards, the major email traffic players have their own additional verification checks. If you or your clients or staff or any other stakeholders or consumers have gmail addresses or other google mail services such as G-Suite, You will need Google Verification. Ask your tech person to click here and follow the process for Google Verification. There are similar processes for other mail relay providers including Apple and Microsoft.

Some further reading

You may also wish to read this article from AccountingWeb which explains it in easy-to-understand lay terms.

Support

If you are experiencing deliverability issues sending mail from your AXLR8 system, please contact Support by email or call. We will review all of the above with you.

AXLR8 Cyber Essentials for 2023-4

AXLR8 Cyber Essentials for 2023-4

Rick Marengo

We have just passed the Montpellier level assessment for Cyber Essentials and we are preparing for the AXLR8 Cyber Essentials Plus audit in January. Thanks again to Right Cue and IASME. This exercise is always encourages thought about our cyber security and is a springboard for the internal trainings and audits for the rest of the year.

Between now and January we are doing our annual Penetration Testing exercise. This is involves attempted hacking by skilled consultants and many vulnerability tests and infrastructure and code reviews.

AXLR8 Corona Virus Resilience

Rick Marengo

In the last few weeks we have been reviewing plans for how AXLR8 deals with the evolving Corona virus threat to all our businesses. We have published information for different markets in which we operate, for example, AXLR8 staffing agency clients. Finance and public sector clients have very different challenges.

  • Isolation: AXLR8 Staff will be working at home a great deal over the next few weeks (March April subject to review).
  • Your Support Service:  we have a great team of client facing sales and support consultants who have the expertise to deal with any queries.  There may be absences (e.g. sickness or care of dependants).  However, our sophisticated internal systems mean they can work from anywhere.
  • Business meetings: kept to a minimum and mostly avoiding crowded transport.  There will be an increase in online screensharing which is mostly accepted by clients with the exception of parts of the public sector. 
  • Security of cashflow: AXLR8 will maintain a portfolio of markets rather than consolidate into a few because it is not yet clear if our survival and future cashflow requirements will be better met by, say, public sector or finance clients. 
  • Supply chain security: AXLR8 have a portfolio of data centre suppliers with a wide geographical and commercial spread.
  • External expert services are hugely valued and the loyalty is two way.  However, neither our business nor their services are irreplaceable.
  • Hiring has been temporarily frozen and budgets tightened “for a rainy day”.
  • Training courses have been cancelled for the next few months.
  • Key people: internal knowledge is shared and expertise overlaps.  However, there would be delayed developments in the event that a key person was absent for any reason.
    • holiday
    • illness
    • other
  • Development resources We ask clients and partners to understand that any developments – especially bespoke designs – will be a little slower than normal.  Software development normally follows the axiom: “More haste. Less speed”.   We will use the right programmers for each change and resulting version control and testing.  If experience is our guide, there are no short cuts. This is your mission critical software.  
  • Bug fixes should be attended to quickly and in the event of sever problems, as ever, other tasks are dropped to start disaster recovery immediately.
  • Financial stability Frankly, our balance sheet will be adversely affected this FY (to March 31st, 2020).  We have invested heavily in new functionality and the new look and feel of our systems.  That would have been fine but for some unexpected recent client liquidations in one of our markets.  However, AXLR8 has no debt except normal payroll and monthly service outgoings for our low overheads.  We are in a strong position to come out of this period stronger than competitors.   Many of those will be extending their funding lines and we believe that some of our rivals are already over-extended and will fail leaving the clients that rely upon their systems in a difficult position.
  • A watching brief is being kept on competitors of our clients entering liquidation to alert our clients so they can pick up the clients and, hopefully, the business from those clients.   The business health of our clients is always paramount for us but now is time where we need to add as much value as possible.

AXLR8 are a low risk, no debt company with a creative, hard-working team. (Boring is looking pretty cool right now).  Our main duty to our clients is to be reliable, stay in business and keep your SaaS systems and support services running.

Our experienced management team have been through some rocky seas in the past including deep recessions. AXLR8 are determined to come out of this stronger. We also expect this is not the last pandemic we see as our connected planet becomes a village.