I'll introduce myself, Dan Brown, I'm with the Cybersecurity and
Infrastructure Security Agency.
We are the newest agency in the federal government under the
Department of Homeland Security.
We are tasked with protecting the sectors of critical infrastructure.
which includes state, local, tribal, territorial, and also the private
sector much of critical infrastructure is owned by the private sector,
whether it's, you know, the Avistas, Columbia Pipeline, whatever.
We will support those folks and offer federally funded slash free assessments
and advising to anyone in those spaces.
So, this is going to be a little more technical conversation.
We did some presentations for Cybersecurity Awareness Month for
WATEC State of Washington Technology, and this presentation and some other
phishing and vishing presentations were saved on the WATTEC Cybersecurity
Awareness Month 2023 website.
I have a link at the very end, so if anyone wants to refer to that and
get some more material, it is there.
, So my agenda is just to talk about the foundational technologies of
email security from the server side.
SPF, DKIM, DMARC briefly touch on Authenticated Received Chain
Email Header Analysis Tools and Conclusions and Recommendations.
I apologize, it'll be kind of technical, not the most exciting, but
I will just offer some information.
first of all, why use SPF, DKIM, and DMARC?
With SMTP, by default, it will permit any computer to send email claiming
to be from any source address, unless you use SPF, DMARC, and DKIM.
So, I do recall once in early 2000s I had a coworker that we used Pine, I
think it was at WSU at the time, and he was able to send an email from Bill.
Gates at Microsoft.
com and it appeared just like it was from him.
There was no authentication, he was able to, it was an open
relay, and was able to do it.
Times have changed, and fortunately we have better
authentication methods in place.
So, the first of those is Security Policy Framework.
Yes.
It's moving forward on mine.
Let's see here.
So he didn't.
Let's go slideshow.
Where's the clicker?
Oh,
so they're separate.
I understand now.
So I can't just make it go.
Right.
Okay.
But I have to forward it here to see my notes.
But that's okay.
We'll do it.
Okay.
So there was my foundation.
Let's see.
Agenda.
Sender Policy Framework.
Basically, Sender Policy Framework is an authentication method to ensure sending,
the sending mail server is authorized to originate mail from the sender's domain.
So in other words, you have to list all of the IP addresses or
domains that are allowed to send email on behalf of your domain.
And it directs policy enforcement actions whether to allow all or Not can be
misconfigured to be overly permissive.
An example of that is if you include a plus all at the end of the SPF
record, it'll allow any IP to send on your behalf, which is not good.
If you use incorrect CIDR notation.
So, for example, you know, , if , your intention is to have a slash 20 and
you inadvertently let, use a slash 2, rather than 4, 000 addresses, you
would allow about a billion addresses, which is 25 percent of all IPv4.
And it's just one character, and that that can leave it wide open.
Okay.
Okay, components of an SPF record there's a version number, mechanisms,
, Quantifiers, and Modifiers.
So, the mechanisms are, you know, describe the host as authorized, inbound
for a given domain and SPF record can have zero or multiple mechanisms.
Some of the common ones are, are quantifiers.
So, in the quantifiers you can have a pass, A hard fail,
a soft fail, or a neutral.
So what does it do with the message if it doesn't meet the
quantifiers in the SPF record?
So, modifiers they're used to send a query to other domains.
Modifiers easy to understand compared to other mechanisms.
Used when you have several domains.
Need to use the same SPF record everywhere.
So, an example, user provide an explanation when a failed quantifier
is included in a match mechanism.
The explanation will be placed in the SPF log, so that's a good
place to get additional data.
So, Example SPF records.
So here is I have two examples here.
And I'll walk through what each of the components are.
The first is the version number.
Everything is SPF1.
That's the current version.
Also on that line is an include.
So you can use an include and it will use DNS.
It will look up all the records for that.
That's, A misspelling of Google, but you get the idea.
It'll list the current version it'll list what the A authorizes
the hosts detected in the A record of the domain to send the emails.
And so if you look in the second one, you see , it has the include and specific IPs.
And.
The SPF, SR, or RFC limits the DNS lookups to match maximum of 10 per SPF, and a
lot of times they say where possible use IP addresses rather than domains
because then you can avoid the lookup time and it'll improve your performance.
So,
okay, whoops.
So this was, I'll take that one.
Okay, so.
Is anyone in here familiar with configuring SPF?
Do you manage mail servers?
Okay.
Have you looked at your SPF record in the last year?
Okay.
That's good to hear.
We have a few.
So, thank you.
I'm glad to know I have a few techie folks in the audience.
So, any questions about SPF that I can answer?
Okay, we'll go on to DKIM.
So DKIM and just for reference, SPF, I believe, it was originally
published in around 2000, and I think it became an RFC in about 2002.
It was very close.
Close to that timeline.
So DKIM is a standard.
It was defined in RFC 6376 in September of 2011, and has had
a couple updates since then.
With DKIM, it allows for a domain to prove it's responsible for a
message, and it was not altered as it traveled its delivery path.
So, the SPF was more with The pathway and who can send and this is more with
the validity of the content of the email.
So there's There is a Signature that's the public key.
It's a public private key relationship and DNS has the the public key published
So then the the message can be encrypted and then decrypted it at time of
reading anyway creates and decodes The DKIM signature DKIM signatures
are inserted into the header of the email and then used at decryption.
And again, I said that's a standard with a couple RFCs.
So
So an example of DKIM this particular one the most relevant
ones are the required ones.
B is for the signature.
BH is for the body hash is for the signing domain, and S is for the selector.
So, if you take a look at that example there, you can see the version number.
You can see they're using RSA whoops.
Okay, there we go, sorry.
So, you can see version 1 gives an example shows the hash there
listed in the, in the text.
And again, that's in the, in the header, so.
And the CNAME record can also be used to point at a different TXT record.
For example, one organization sends on behalf of another, so.
Let's look at Okay, so DMARC, actually improves upon the existing
security measures of DKIM and SPF.
It kind of ties them together, if you will.
A DMARC policy allows a sender's domain to indicate that their messages are
protected by SPF and or DKIM and it tells the receiver what to do if neither of
those authentication methods pass, such as to reject the message or quarantine.
So does it end up in the spam or just get spam folder or just get rejected?
And DMARC kind of works with domain alignment requires SPF and DKIM to be
in place and domain alignment basically means that they need to match the message
from the domain with the return path domain from the sending domain to the
return path domain just to ensure that someone's not trying to send it out as
As a known domain, and the return path if they hit reply is different, so.
And, basically you have to create a proper DNS text record for this,
and that'll tell the policy where it reports to and the subdomains.
Okay, I think it skipped one.
Okay, there's a sample config so in DMARC, in this, this example you
know, It shows the version number, DMARC1, again, it's current version.
And it shows what it does, whether it quarantines, what percent of the
mail messages are are being scanned and run against that rule set.
The subdomain policy and what you are all to send the reports to.
It's very helpful if these, these reports get sent, if you're a male
administrator, it gives you a good chance to look at those and you know, and see
what is failing and why it's failing.
So, let's see what else we got.
Okay, so let's go.
And this is an example of a report.
It basically just shows, you know, How each message was affected,
whether it passed, failed, and why.
You know, if it passed SPF and DKIM, or just one or the other,
and what the resultant action was.
So, they're typically sent once a day, and this one has been reformatted in
tabular form just to be easier to see.
One additional comment I'll make is most of this is Is available you
know, the technology hasn't changed.
I listened to a number of podcasts and did a bunch of research on this.
And the most relevant information is from delivery experts ESPs
professional mail people that are using mail to send out marketing email.
They're sending thousands or millions of email.
And they want to make sure that their email gets through.
So They talk about it from a little different lens, but the the technology is
still all the same and you need to have it configured in such a way that that good
mail gets through and bad gets rejected.
So, future additional options.
Come on.
Oops.
So, there are some different email configuration technologies
in, that are out there.
One of them is a brand message indicator.
Brand indicator for message identification.
It uses DKIM, SPF, and DMARC to verify.
Adds a brand logo to the name of the email sender's additional validation.
Again, the email marketing companies are in support of this because then they can
show that it's actually from their company and it'll show their logo as an additional
form of authentication and validation.
So, Another is new security features that were launched by Google on
October 3rd of 23, and they're coming from Yahoo in February of 24.
And basically, bulky email senders that send more than 5, 000 messages
will have to have a new, will have new authentication requirements.
So, for those You know, marketing folks that send out lots and lots of email, they
will have requirements and the intent is to you know, reduce the number of spam.
And the senders will be required to process unsubscribed
requests within two days, so.
The third one that I'll, I'll talk about as an option is
Authenticated Received Chain or ARC.
Basically it makes a list of trusted ARC senders to trust
legitimate indirect mail flows.
So, just another configuration option.
And there's an example of MARC.
Basically it's, it helps to keep the message from being modified in transit
and adds a list of trusted intermediaries.
And it just shows I have two, two graphics.
One that shows a mail flow with ARC and one without.
And just that adds an additional DNS check through the pathway of mail.
And it shows, yeah, when you, and for this you have to use DMARC, so.
Okay real briefly we'll talk about message header analysis.
So, it's a, it's a great tool that's available in nearly all email clients,
allow you to see technical details.
About routing and pathing, including DKIM information.
Every header is different and some metadata is optional.
But the first four first four are required.
Send a recipient, date, and subject.
So anti spam laws for most countries require the following.
A from label that should either be the name of your business or your own name
if your subscribers know you by that.
The reply to address needs to be a functioning address and should connect
to you or someone at your company.
You can answer questions.
Also the sending, the domain in your sending email needs to be correct.
And the subject line this is a bit more tricky.
The subject line must pertain to the content of the email in some way.
Doesn't mean you can't have fun and have a tricky email line, but you
can't say this is an email from Dr.
Smith confirming your appointment on Tuesday, and then open it up and
have someone try and sell you you know, a new laptop or something.
It has to be related to the content in the email.
And again, the country laws are a bit different, so you have
to review those on your own.
Okay.
And this is just how you get in.
I mean, most of you folks probably know how to do that.
Just go into, look at message headers and some will have more details than
others, but, you know, same idea.
Okay, and this is an example of a message header.
It's kind of difficult to see but it's a message from from biola.
edu, from Stephanie to David.
This particular one happens to be an internal email.
And you know, it's an example of how full email headers are more from lines.
They contain information including every hop a message is taken across the internet
to get from the sender to the destination.
You know, the required areas Stephanie's report the return
path is, is Stephanie's address.
Tells you any replies will go there, not another account.
Received from has to be correct.
And because it is correct, on C it's a pass.
Because we see that the IP address is a permitted sender.
So all email from biola.
edu will be handled by Google, since they provide their email service.
Let's see.
Okay tools.
There are a number of tools out there.
If you just, you know, do a search for SPF tools or SPF, DKIM, DMARC
check there's a number of free tools and most of them have a paid option.
The one I used for some of my examples was Demartian, you know,
again, not necessarily the best.
It's just one that shows you can put your your email domain in and
it will tell you if your SPF, DKIM, and DMARC are properly configured.
And it will also tell you your status on a blacklist.
I believe there are 90, about 93 common blacklists.
And one example of this I can recall where it was an issue when I worked at WSU.
We had one of our emails that ended up on a on a blacklist.
And, and we had grant federal grant information that was trying
to come through in that email.
I don't remember if it was Department of Education, but either way, that
email was not allowed to come through because we were on a blacklist.
So, it's important to at least know your status and make sure that
somehow you haven't gotten there.
Okay, whoops.
Okay.
Oh, that one got put in the wrong spot.
That's just an example of SPF records.
That should have been up above.
So, here, again, I mentioned DMARC.
And this is an example I put in NASA.
gov just to see what it said.
And, you know, you can expand out and see what the DMARC, the
SPF, and the DKIM records are.
It'll list the the public key.
For DKIM, you can see it there cause that's available in DNS, and your
SPF and DMarker are configured.
But, you know, it's a good starting point, pick one of the tools take a look
and see what your domain looks like.
So, have, have any of you folks used some of these tools?
Which one did you use?
What's that?
Okay.
Nice.
That's good.
And do you use the free versions or the paid versions?
Yeah, and that's it.
I mean if you, okay, so I got two.
Or, or, peace out.
I guess it's the same.
So yeah, they're good tools.
I would recommend using them.
Conclusion, review your existing config, use tools, check DNS, add,
modify and update as necessary.
Review your client settings to make sure that you have security features enabled.
You know, if it's a Windows box, use group policy to push
out the appropriate settings.
Research new email trends you know, I mentioned email service providers,
they have blogs and podcasts again, they're delivery professionals.
It's from a different stance, you know, the marketing side, but the technology is
still the same and you can learn a lot.
And AI and analytics are also being used heavily by providers to help filter spam.
So even if it's, if something looks fishy in an email, you know, there
might be additional technologies that are blocking it even if you don't have
everything configured quite right.
So, that's, that concludes it.
Again WOT Tech had Cybersecurity Month and there's a copy of this
presentation that I provided on my own laptop when it was working.
And There's a recording if you want to look at it.
I'm Dan Brown.
I am the local cybersecurity advisor for Spokane area.
My email is there.
Grab a card on the table in the back.
Come talk to me.
I'd be happy to help.
So thank you.