The limits of Sender Policy Framework
Sender Policy Framework (SPF) is an email authentication protocol that can be used to prevent spammers and attackers from sending messages that appear to come from a trusted domain. Using the SPF email protocol, an organization can publish a list of authorized mail servers in an SPF record that appears in its DNS record. Receiving mail servers can perform an SPF test on every inbound email, checking to see if the IP address from which the email is sent matches an IP address in the domain's Sender Policy Framework record.
While the Sender Policy Framework offers a certain amount of protection against spam and spoofing, it is not a complete email security solution. A forwarded email will evade an SPF test, and the SPF protocol can't spot email that spoofs only the "from" address – the email address that's visible to users. Additionally, for Sender Policy Framework to work, organizations must keep their SPF records constantly updated – a time-consuming and cumbersome task that gets harder as companies change ISP providers.
DMARC, or Domain-based Message Authentication, Reporting & Conformance, offers an improvement on the Sender Policy Framework protocol as well as the DKIM protocol. DMARC prevents spoofing more successfully by requiring that the information in the "from" address align with other information about the sender, and it requires that a message is authenticated with either SPF, DKIM or both. DMARC also improves reporting and provides detail on how messages that fail authentication should be handled.
In the past, implementing DMARC authentication has been a challenge. The protocol can be difficult to deploy and hard to manage, requiring a significant investment of time and resources. To solve this challenge, Mimecast offers Mimecast DMARC Analyzer, an easy-to-use solution for streamlining DMARC implementation and management.
