Can anyone send e-mails in your name?

Why anyone can write in your name

E-mail was designed in the 1980s, between universities that trusted one another. Nothing in the original protocol verifies the sender's identity. Writing an e-mail that displays [email protected] requires no password, no hacking and no particular skill. It is like writing whatever name you like on the back of a postal envelope.

In practice, a fraudster can send an invoice to your customers with your colours, your signature and your sender address, simply changing the bank account number. They can also write to your accountant while pretending to be you and demand an urgent transfer. This is the mechanism behind CEO fraud, which costs Swiss companies millions every year.

Three mechanisms have been added over time to fill this gap: SPF, DKIM and DMARC. They are simple lines of text published in your domain name configuration. They cost nothing. In most SMEs in French-speaking Switzerland, they are missing or badly configured, often because no one has ever asked the question.

SPF: the list of your authorised senders

SPF is a public list of the servers authorised to send e-mails for your domain. Your e-mail host appears on it, as do your invoicing software, your newsletter tool and your website's contact form.

When a message reaches your customer, their server consults this list and compares it with the actual sender. If the message comes from an unknown server, it is suspicious. The end of the list indicates what to do about it. A record ending in -all requests a firm rejection. ~all only asks that the message be treated as doubtful. ?all or +all request nothing at all and make the protection useless.

The fix consists of listing all your sending services, then publishing a single record that lists them. A domain must never carry two SPF records: verification then fails for most recipients.

DKIM: the signature that proves the origin

DKIM adds an invisible electronic signature to each message you send. Your server signs with a private key, known only to it. Your domain publishes the corresponding public key. The recipient verifies the signature and knows two things: the message really comes from your infrastructure, and its content has not been altered in transit.

The public key is published under a name called a selector. Each host uses its own. This particularity has an important consequence for our tool: it is impossible to guess a selector from the outside. We test the most common ones, but a lack of detection never proves the absence of DKIM.

The fix is almost always a checkbox at your e-mail host. It generates the key and tells you the line to publish in your DNS zone.

DMARC: the instruction given to others

SPF and DKIM make it possible to detect spoofing. They do not say what to do about it. Without instruction, each server decides on its own, and most deliver the message anyway. This is the role of DMARC: to give the instruction, publicly, once and for all.

Three instructions exist. p=none requests no action and serves only to observe. p=quarantine asks that the message be classified as spam. p=reject asks that it be refused, without even delivering it to the spam folder. Only the last one truly protects your customers.

DMARC brings a second benefit that is too rarely used. By adding a reporting address, you receive each day the list of servers sending messages in your name. You then discover your own forgotten services, and the spoofing attempts you are the target of.

The rollout is always done in three stages, never at once. First p=none for a few weeks to observe, then p=quarantine, then p=reject. Going straight to rejection would make your own invoices and order confirmations disappear.

What this tool does not test

This tool reads three public records. It connects to no server, sends no message and accesses no mailbox. It therefore misses several important things.

It does not check that your SPF record is accurate: a domain may publish a list that looks correct but has forgotten your invoicing software. It does not detect custom DKIM selectors. It does not test look-alike domains, the ones a fraudster registers by changing a single letter to bypass all these protections. It says nothing about the security of your mailboxes themselves: a hacked e-mail mailbox sends perfectly authenticated messages, since they leave from your genuine account.

Nor do these protections filter what you receive. Against phishing that reaches your mailboxes, you need dedicated filtering and staff trained to spot the signals. To place your overall protection in context, the cyber check-up covers the twelve fundamental measures in three minutes. The site's other tools complete the picture.