Tag: DMARC

DNS DNS records

DKIM record – definition

Once you get into the DNS game, you have to know the tools to play and face every challenge ahead. The DNS has its structure, but it can be adapted to your specific needs. The only way to enjoy the benefits of its flexibility is to play with its different “cards”. Let’s define the DKIM record to know what it has in store for you!

What is the DKIM record?

DKIM record or DomainKeys identified mail is defined as an e-mail security standard created for domains to prove the e-mails sent on their behalf are authentic. To enable it gives certainty about your messages’ trustability to recipient servers. This is not a minor contribution to security in the current times. DKIM also protects messages from being altered while traveling from the sender server to the recipient server. Basically, these important functions are achieved through cryptography.

How does the DKIM record work?

The DKIM technology allows domains to sign outgoing messages using cryptographic authentication. When you enable DKIM, it will work through the use of two cryptographic keys, one private and one public. The private key will sign e-mails when they leave the sender server. The public key is published into the domain’s DNS record to be available for the recipient servers to authenticate the messages’ source and check the integrity of the messages’ body. If the signature gets verified by the recipient server (via the public key), the messages are considered authentic.

Let’s now be a bit more technical. As an administrator of a domain, you have to publish the cryptographic public key using TXT record format. This step is a must for recipients to verify the authenticity of the message’s sender. When the mail server sends an e-mail, DKIM will create a digital signature and attach it to the message’s header. 

At this point, for sure, you may wonder what exactly a digital signature is. Well, it’s a hash value, a unique line of text properly encrypted with the private key, that must remain exclusively in the administrator’s control. Otherwise, security can’t be guaranteed.

DKIM has, as a part of its functionality, multiple algorithms for generating this digital signature. Every detail linked to the signature’s production process is written in the message’s header. Additionally, two cryptographic hashes are included. One is connected to the defined headers and the other to the message’s body.

The sent e-mail travels and arrives at the recipient mail server. This triggers a DNS query to search the public key of the sender domain for verifying the message. The recipient mail server gets it and proceeds to decrypt the digital signature. The hash values can now be compared with the values within the message. A match of these values will define the authentication of the e-mail. Besides, the recipient mail server will confirm that the message was not altered in transit. Therefore, security for the recipient while accepting this e-mail is guaranteed.

Advantages of having a DKIM record

  • It’s easy to configure. An administrator can directly do it.
  • It’s an efficient shield against forged and dangerous e-mails. Through DKIM, you can secure the messages sent from your domain not to be altered and damage recipients and your reputation.
  • It helps to avoid phishing and spoofing.
  • It provides security to your domain’s mail server, and its possibilities can be expanded if you combine it with other DNS records like DMARC.

Conclusion

The DKIM record means security for your domain mail server and for your clients (recipients). It’s by definition a security ace you should have up your sleeve!

DNS DNS records

What is the purpose of the DMARC record?

If you don’t feel like reading the 70+ pages of RFC 7489, but still you want to know more about DMARC, you came to the right place! I will simplify it for you and explain to you DMARC and the DMARC record in less than a few minutes!

What is DMARC?

Domain-based Message Authentication, Reporting, and Conformance (DMARC) is a mechanism that an organization can use to define domain-level policies and preferences regarding email handling. For example, message validation, disposition, receiving, and reporting.

The companies require a method of authentication of the domain names of the messages (emails) that they are receiving. They need to have rules and procedures based on the values that the emails and domain names can provide. Thanks to that, the receivers can check the messages and provide valuable feedback to the domain’s owner about the way its domain is used. The owner can see if there was any abuse of its domain.

DMARC uses two factors to set policies:

SPF (Sender Policy Framework) record. It is another email validation mechanism that offers to report. Using it, you can define who can send emails on the domain name’s behalf.

DKIM (DomainKeys Identified Mail) record. DKIM is a method of email encryption and authentication of the sender of the email, using the domain name. The receiver could use it and validate that an email comes from the right domain name.

The purpose of DMARC is to reduce phishing attacks, reduce spoofing attacks, and provide better security for email communication. In general, having DMARC will ensure the delivery of your emails and stop other people from abusively use your domain name for attacks.

What is the DMARC record?

The DMARC record is a DNS TXT record that sets the policies about the domain name based on the SPF record, DKIM record, and other parameters. It sets behaviors that the receivers of the emails, sent by a particular domain, should have.

The purpose of the DMARC record is to allow you, as the domain administrator, to set up the policies regarding the handling of the emails coming from your domain name.

The tags that the DMARC record uses are:

Adkim – behavior based on the DKIM record.

Aspf – behavior based on the DKIM record.

Fo – Fail option. Defines what a server should do in case of failure.

P – Policy. Indicates the policies that the receiver should apply.

Pct – Percentage. To what amount of emails should the policy be applied.

Rf – Report format. Defines the type.

Ri – Report interval. Demands reports after the specified time.

Rua – Return feedback (aggregate). Indicates where the report should be sent.

Ruf – Return feedback (mail specific). Indicates where the report should be sent.

Sp – Subdomain policies. If you want to indicate different policies for the subdomains than those for the domain name, you need to use this one.

V – just a simple version indicator. Currently, it should be DMARC1 because there is still no DMARC2 or more.

Conclusion.

So, knowing what DMARC record is, it is now time to implement it. Each additional layer of security keeps you safer—fewer problems and easier to manage. Ensure a secure exchange of emails, outgoing and incoming, with the power of DMARC!

DNS DNS records

​TXT record – What is it and why do you need it?

If you are searching for the TXT record, you are probably interested in email security and all the methods of authentication and validation of a domain. So, Let’s not waste any more time and see what the TXT record type is all about!

​What is the TXT record?

The TXT record is a type of DNS resource record and serves to associate data with the domain. The data could be a human-readable text, or it could be different information about servers and networks that could be read by machines only.

Usually, DNS administrators create various TXT records to ensure the proper functionality of the email servers. That way, the emails that are sent could be verified, and their origin could be authenticated.

The TXT records can be hosted as most of the other DNS records inside a Forward DNS zone. You can host multiple TXT records for different purposes, which won’t create problems between them.

You can see the TXT record first mentioned and read more about it in the RFC 1035 by the creator of the DNS – P Mockapetris.

​Why do you need a TXT record?

The current uses of TXT records are the following:

  • Ownership verification. It is one of the easiest ways to prove that you are the owner of a particular domain. Many services ask you to add a TXT record to the domain name. If you are the administrator, you could be able to do it. If you are not, this will be impossible.
  • Sender Policy Framework (SPF). This is a mechanism for verification of the sender and reporting. It could lower the SPAM.
  • DomainKeys Identified Mail (DKIM). This is an encryption method that prevents email spoofing. It uses public and private keys and keeps the keys inside TXT records.
  • Domain-based Message Authentication, Reporting, and Conformance (DMARC). It uses a combination of the previous two, the SPF and DKIM, and creates behavior policies. It boosts security.
  • Zero-configuration networking DNS-based service discovery. It is used for fast network configuration.

​How to check your TXT records?

You can see all the TXT records for a hostname/domain name by performing a DNS lookup.

​On Linux

Open the Terminal and use the dig command to perform a TXT DNS lookup:

dig hostname/domain name TXTs

You need to change “hostname/domain name” with the one you want to see.

​On Windows

Open the Command Prompt and type the following command:

nslookup -type=txt hostname/domain name

​On macOS

Open the Terminal, and use the nslookup command to see the TXT record:

nslookup -type=txt hostname/domain name

​Inside any browser

You can also use any browser, including your mobile phone’s one, and use an online utility for TXT lookup.

You can try Mxtoolbox.

Open it, write the hostname/domain name, and press TXT Lookup.

​Conclusion.

Now you know that the TXT records could hold different information about the domain name. It is mostly a tool for domain authentication, but also it can be used to show that somebody has access to a domain and the right to modify its DNS records. It is often the case that big cloud providers require you to put a TXT record for your domain so that you can use their services with that domain name.