How DKIM SPF & DMARC Work to Prevent Email Spoofing

[@triggeredsydney]

This is the best DMARC video in KZbin.

[@nourahsaad9810]

I have watched many videos, no one explained it as you did!! amazing many thanks

[@lex4089]

This is an absolutely FANTASTIC video. You explain it so clearly and pitch at a good level. Thanks for putting it out there. It helped me a lot.

[@MDaemonTechnologies]

Thank you! We're glad you found this video useful.

[@sureshmadurai5044]

Fantastic explanation. After long time , I am able understand DMARC. thank you.

[@MDaemonTechnologies]

Thank you for the feedback!

[@lostsoulparty]

Just understanding the basics and this was a perfect place to start

[@christophersears6181]

Simply amazing- Great job with breaking down how all of these protocols work together. Great Job

[@pierreleonsimard]

OMG! Lots of years that I've been trying to understand all of this. Now, I do !!!! Thank you for this very good video !

[@MDaemonTechnologies]

Glad you found it helpful!

[@pierreleonsimard]

@@MDaemonTechnologies I also subscribed to you and activated alert and now I'm browsing your videos instead of working. HAHA. Another proof that good content works better than ?%//$ clickbait 😅

[@stephenawele5478]

God bless you. You have made my day by making this lesson so simple to understand through your video. I would give a million like if it were possible.

[@bersi3306]

This video I must say that is great. I've learnead a lot from it, and it is so far the simplest. As a future computer engineer, thank you very much!

[@ravindrabhosale2915]

Before this video I went through many others but no clarity...very nicely explained. Thanks a lot. Keep sharing more.

[@paulgray1399]

Clear and simple explanation. Excellent work.

[@MDaemonTechnologies]

Glad it was helpful!

[@ITTechTips4You]

This was simply THE best overview-Tutorial on this topic. Thank you so much - just subscribed to your channel.

[@ersingokay2670]

Awesome, could not be explained any better than this. thank you for putting this very useful video together and sharing it with us. God bless you

[@MDaemonTechnologies]

Glad you found it useful, Ersin! Brad

[@jdgregson]

You should do a more in-depth video and cover things like what header SPF uses to validate the sending server (Mail-From), what headers are generally used to calculate the DKIM signature, why and how forwarders frequently break DKIM by changing headers, and what "alignment" actually means in regard to DMARC (the domains used to pass DKIM and SPF must match the domain in the "From" header).

[@_m.a-x]

You got me curious! Can you make a video?

[@jdgregson]

@@_m.a-x I've thought about it. I want to figure out how to manually calculate and verify a DKIM signature first.

[@Ru9sal]

This was an amazing tutorial! Thank you for showing real life scenario.

[@MDaemonTechnologies]

Thanks for commenting. Glad you found this tutorial useful! Brad - MDaemon Technologies

[@youcanthandlethetruth3406]

I agree ☝️

[@techheadtips6042]

Very well explained. Excellent job.

[@samrithsem7087]

Thanks for sharing useful tutorial.

[@cwhiii]

Clear and concise. Beautiful.

[@MDaemonTechnologies]

Thank you!

[@HishanShouketh]

Well explained, great flow. Thankyou very much

[@naveenvanamala4123]

is that security gate way freetool

[@simonselvin1]

Excellent Explanation !! Thanks for the video. Just one query I had the receiving mail server quarantines or rejects mostly based on the DMARC settings published by the sender. So believe just like SPF and DKIM, DMARC is also queried to take that decision and we can always alter that decision at the DMARC policy-setting on our end too.

[@MDaemonTechnologies]

Yes, while domain owners can set their preferred quarantine/reject policies in their own DMARC records, SecurityGateway administrators can override those preferences to handle those messages based on their own needs. Brad Wyro MDaemon Technologies

[@TheGayan1984]

very useful with easy explanation , thank you

[@MDaemonTechnologies]

Thank you. I'm glad you found this video helpful! Brad - MDaemon Technologies

[@stefanminehan]

We are looking to implement DMARC also and so this was a great explanation, nicely presented. Cheers :)

[@MDaemonTechnologies]

Thanks Stefan. Glad you found it useful! Brad

[@viishhnu1086]

Superb explanation

[@ToniWCampbell]

Wonderfully explained!

[@demonview6075]

Excellent video - thank you

[@SVDwarakesh]

Thanks for your tutorial, this was really helpful.

[@MDaemonTechnologies]

Glad you found it helpful!

[@druim-nan-deur]

very good sir

[@danielpatrick6876]

this is excellent guys. thank you

[@vercixxx]

Very well explained, good job!

[@genericusername5520]

where could I have learned thist stuff, and how to have set it up from the beggining?

[@SachinWaradB]

Just excellent tutorial.

[@RedEyeCoding]

really nice video

[@digidyle]

Well explained, thank you, now understand this much better.

[@viishhnu1086]

Excellent

[@jlmf6274]

Great video, thanks!

[@_m.a-x]

Also a question - SPF alone has matching policies (hard, soft etc), same goes for DKIM. What is their role and effect when there is DMARC in place? If, say SPF dictates to allow all, while DKIM or DMARK policy says otherwise and is in direct conflict, which one action takes precedence?

[@MDaemonTechnologies]

Hello Max. I did some research on this and found that the recommend practices while deploying DMARC is to set your SPF policy to SOFTFAIL (~all) while your DMARC policy (p= tag) is set to p=none. Then, after you've had enough time to review your DMARC forensic & aggregate reports, set your SPF record to HARDFAIL (-all) and then, at that time, set your DMARC policy to p=quarantine or p=reject. - Brad

[@prithviraj1080]

Thanks!

[@amertat782]

in this time of video (8:22) i notice that you had a txt record for DKIM which is not correct because you name it as "dkim" , i think it's not working in practical scenarios because it should be named like "selector.domainkey" otherwise recipient servers could not query this correctly (Based on my Test) , idk maybe you named it just for learning aspects. anyway thank for your great video

[@oseexplica2807]

Tks bro

[@octetmasquer]

Good job, thank you!

[@MDaemonTechnologies]

Thank you!

[@MajTe0b]

Thanks for the clear tutorial, what about configuring the protection of SMTP itself? my application tries to send an email to SMTP and it gets always blocked by the ISP for spam related protection.

[@MDaemonTechnologies]

Are you using a business email account? What application are you using? Are you referring to your email client? If you are sending mail through your ISP from an on-premise mail server, or via a hosted email service, many ISPs block transmission on the standard SMTP port - port 25. Do you know what port you're using for SMTP? Brad

[@thinking-laaf]

Interesting what they did (feels a bit like a hack) to 'fix' holes in the original SMTP protocol to deal with spam. I suspect that this does slow down mail processing a bit... No longer a 'Simple Mail Transfer Protocol' ....

[@sunflower-ghy]

thank you very much! it helps me a lot:)

[@PoloJ410]

Can you have spf and dkim configured in Office 365 and configure dmarc separately in Proofpoint? Or do all 3 have to be configured in one place?

[@MDaemonTechnologies]

DKIM, SPF & DMARC are all implemented via DNS records, so they are not product-specific. If mail from your domain is sent from both Office 365 and Proofpoint, then both would need to be included in your domain's SPF record, and both would need to be able to sign outbound messages with DKIM. Your DMARC record would simply tell receiving servers how to handle messages that don't properly align with DKIM & SPF. Brad

[@StreetArtist360]

Thank you.

[@yusufbala990]

Please what are the general requirements to implement this in our organization?

[@MDaemonTechnologies]

Hello Yusuf. You will need to first implement DKIM and SPF. You will need to publish a DKIM (public) key to DNS, and sign outbound mail with the private DKIM key on your mail server or gateway. For SPF, you will need to set up an SPF record in DNS that designates servers that are authorized to send mail on behalf of your domain. Once DKIM & SPF have been implemented, you can then create a DMARC record and then deploy DMARC. Here's a webinar I conduced that provides an overview of how to deploy DMARC. It's a few years old, but the same concepts still apply. kzbin.info/www/bejne/rKOwfn6jraigp9U Brad Wyro MDaemon Technologies

[@yusufbala990]

MDaemon Technologies thank you

[@leadsfix5595]

This video is like teaching someone what water is made of and various variables of water and how it works when all I'm trying to do is learn how to swim. Do I really need to know all this extra stuff to just send an email? The answer is no, however just telling us how to utilize SPF, DKIM, and Dmarc would of been helpful.

[@sganpisetty]

Thank you for the video, May I know the Security Gateway appliance is Hardware or software, give me the details about it. Thank you in advance.

[@MDaemonTechnologies]

SecurityGateway is software that runs on Windows. You can download it here: www.altn.com/Downloads/SecurityGateway-Free-Trial/ We also have hosted options, which you can learn about here: www.securitygatewayforemail.com/ If you need further assistance, I'll be happy to help. Brad

[@sganpisetty]

@@MDaemonTechnologies Thank you very much for quick response.

[@TheTerminator317]

Is there anyway to force DKIM and not SPF? In other words can DMARC be forced to use DKIM and ignore SPF? thanks

[@MDaemonTechnologies]

DMARC was designed to use both DKIM and SPF. If you've only implemented one or the other, then you could still use DMARC's reporting feature to receive aggregate & forensic reports indicating how your domain is being used. This article explains using DMARC with only SPF (and thus, it's the opposite scenario from what you're asking), but you may find some of its content helpful. dmarc.org/2017/03/can-i-use-dmarc-if-i-have-only-deployed-spf/

[@TheTerminator317]

@@MDaemonTechnologies thank you

[@sanzhar.danybayev]

What stops the intruder from getting the public key from the DNS and setting it as the signature??

[@MDaemonTechnologies]

Hello Zanzhar. The message is not signed with anything that's publicly available in DNS. DKIM uses a "selector" to sign messages with the corresponding private key. The public key is there to provide the receiving servers performing DKIM verification (that have the emails containing the private key) something they can download and check against the private key, but those keys are not exact duplicates of each other, so a potential hacker can't simply take the public key from a signed message & use it to sign outbound messages. - Brad

[@sanzhar.danybayev]

@@MDaemonTechnologies wow thank you Brad for the answer! Didn't expect that it'll be so fast 😮 much appreciated!

[@MDaemonTechnologies]

@@sanzhar.danybayev You're welcome. Please let us know if you have any other questions! - Brad

[@sanzhar.danybayev]

@@MDaemonTechnologies now thanks to you everything is clear!

[@mertkaracayil]

DKIM SPF & DMARC will be a major issue for businesses & individuals in 2024. so many businesses are sending emails and emails are ending up in spam. going to be a lot disruptions for businesses and plenty of work for people in I.T. written in Jan 2024....

[@jrodrig9212]

Nice

[@MDaemonTechnologies]

Thanks!

[@thebushscientist4473]

Why dns record is created with name dkim. Shouldn't it be your selector name?

[@MDaemonTechnologies]

Yes, you are correct. It should be the name of your selector. I was just using DKIM as an example.

[@ncschulze]

SPF breaks email forwarding. Because the forwarding server is no longer allowed to deliver. Better use DKIM.

[@bklan9899]

You could and should use both DKIM and SPF. Any server capable of forwarding mail on your behalf would need to be present in your SPF record either by name or IP.

[@HardwareRules]

i wish people would stop saying, 'tools.'

[@TheBaltimore69]

dkim is not very clear

[@MUTHU20241]

Good video but i watched in 1.25x speed

[@aniketnanekar5133]

spf record generate , not understand , can u pls help

[@MDaemonTechnologies]

Hello Aniket. I've created a tutorial video that explains the SPF record creation process. You can watch it here: kzbin.info/www/bejne/b6PRYqeOf5t7i80 Brad

[@Basieeee]