What is Email Spoofing and How to Protect Against It

What is Email Spoofing and How to Protect Against It

Email spoofing is a threat that involves sending email messages with a fake sender address

Difference between Spoofing and Phishing

  1. Spoofing refers to a form of identity theft where someone uses the identity of a real user.
  2. Phishing involves someone stealing sensitive information such as bank or credit card details.

Working of Email Spoofing

Email spoofing exploits the fact that email operates similarly to regular mail, consisting of three main components: the envelope, the message header, and the message body.
A spoofer can manipulate not only the body and “To:” fields, but also customize other key fields such as:

Mail From:
Reply To:
From:
Subject:
Date:
To:
When the spoofed email reaches the target's inbox, the email client displays what’s entered in these fields, creating a deceptive appearance. This can make it seem as though the email came from a legitimate source when, in reality, it did not.

How to protect against email spoofing

We can take action to prevent attackers from sending messages from their domain. To do so, we have to create Domain Name System (DNS) records specifically for authentication. These include:
  1. SPF (Sender Policy Framework) verifies that an email has been sent from an IP address authorized to send emails from the sender’s domain.
  2. DKIM (DomainKeys Identified Mail) cryptographically verifies that the sender’s address and message contents haven’t been changed in transit.
  3. DMARC (Domain-based Message Authentication, Reporting, and Conformance) ensures that the domain in DKIM and SPF checks matches the sender’s domain in the From field, an essential check for spoofing.


Sample DMARC Policy

  1. Determine Your DMARC Policy:
    1. None (p=none): Monitor emails without taking any action.
    2. Quarantine (p=quarantine): Mark emails that fail DMARC checks as spam or junk.
    3. Reject (p=reject): Reject emails that fail DMARC checks outright.
  2. Set the DMARC Record Parameters:
    1. v=DMARC1: Specifies the version of DMARC being used.
    2. p=none|quarantine|reject: Specifies the policy for handling emails that fail DMARC checks.
    3. rua=mailto@example.com: Specifies the email address to which aggregate reports should be sent.
    4. ruf=mailto@example.com: Specifies the email address to which forensic (detailed) reports should be sent (optional).
    5. pct=100: Specifies the percentage of emails subjected to the DMARC policy (100 means all emails).
    6. sp=none|quarantine|reject: Specifies the policy for subdomains (optional).
    7. adkim=r|s: Specifies DKIM alignment mode (relaxed or strict).
    8. aspf=r|s: Specifies SPF alignment mode (relaxed or strict).
  3. Generated DMARC Record:
    1. v=DMARC1; p=reject; rua=mailto:"email address"; ruf=mailto:"email address"; fo=1; adkim=s; aspf=s; sp=reject; pct=100; ri=86400
  4. Copy the generated KEY and add it as TXT record in corresponding DNS

    • Related Articles

    • How to Enable the Auto-Expanding - Online Email Archive using PowerShell

      Install and Connect to the Exchange Online PowerShell Module Root Cause: Auto-expanding online Email archive for exchange online plan2 users. Install the Exchange Online Management Module: Open PowerShell as an administrator. Install the Exchange ...

    • Onsite Tech Request

      RMA No:   Case No: Delivered Date of RMA: Purpose of Onsite Tech Request: Will the Tech need Security Access for the Site? Yes or No Requested Onsite Date /Time: Has Security Access been set up? Yes or No Replacement Parts already at Site: Y/N Serial ...

    • Add user account in mbuzztech portal

      Mbuzz Support Portal Account MBUZZTECH portal account is required to access Support Center. Support Center contains Knowledge Base, Community and Tickets Knowledge Base - Browse through our collection of articles, user guides and FAQs. Community - ...

    • How to manage tickets in NVIDIA NPN Portal

      Prerequisites Ensure you have access to the NVIDIA Partner Network (NPN) Portal. Method 1: Submitting a Support Ticket via Email You can create a support ticket by sending an email to NVIDIA Enterprise Support Case at: ? enterprisesupport@nvidia.com ...

    • ASUS RMA- Whole unit

      For RMA for a WHOLE UNIT replacement, we require the following information: Company name: Company address: City: State: Zip: Local Contact name: Local Phone number: Local Contact's email address: Special instructions: Defective Serial number of unit: ...

    • Popular Articles

    • CP Plus Camera and NVR Configuration

      NVR Configuration The CP Plus Pro Series of NVRs have been meticulously designed for providing you with upgraded performance and higher recording quality in your IP video surveillance solution. The robust processor that has been inculcated in this ...

    • Kerberos Authentication – Overview

      What is Kerberos? Kerberos is a secure authentication method used in our Active Directory (AD) environment (mbuzztech.com). It allows users to: Access multiple systems without re-entering passwords (Single Sign-On – SSO) Log in once Where We Use It ...

    • How to Remove and Reinstall NVIDIA Drivers on Ubuntu

      This article provides step by step guide to completely remove existing NVIDIA drivers and reinstall specific version of the NVIDIA driver on the Ubuntu system Prerequisites Administrative (sudo) access to the Ubuntu system. Internet access to ...

    • Personal Computers and Servers - Classification and Point of Contact

      We can classify the computers that MBUZZ handles based on their form-factor as below: Tower Workstations, Desktops, Gaming PCs and SFF (Small form factor) PCs fall under this category. These are computers people would use on a desk and rarely move. ...

    • M.2 SSD Tier List

      The sequential read and write speeds, which are usually the most advertised number, are not a proper benchmark of real-world performance or the quality of an SSD. This article categorizes and tiers SSDs based on factors like the type of NAND flash, ...