Understanding and Preventing Email Spoofing Through DMARC Reports: A Technical Analysis

After implementing email authentication for my domain, I started receiving DMARC reports. These reports contain vital information about email authentication status and potential security issues. This article examines the contents of these reports and discusses the importance of email security enhancement.

Analyzing DMARC Reports: Unexpected Discoveries

Despite sending only 1-2 emails per week, I received DMARC reports at a higher frequency. Here's an analysis of one such report:

Report Analysis

1. Report Metadata:

   • Organization: docomo.ne.jp
   • Report ID: 0fa82be0508dfbf0734d46e8472e525e
   • Date Range: September 26-27, 2024

2. Published Policy:

   • Domain: aqz.jp
   • DKIM Configuration: s (strict)
   • SPF Configuration: r (relaxed)
   • DMARC Policy: none
   • Policy Application Rate: 100%

3. Identified Issues:

   • Multiple IP addresses sending emails (e.g., 49.72.81.163, 49.64.241.80)
   • DKIM and SPF failures across all records
   • SPF results showing "permerror" (permanent error)

4. Evaluation Results:

   • All messages show disposition as "none" due to DMARC policy settings
   • No actual restrictions applied due to "none" policy

Investigation of Spoofing Attempts

Further investigation of the source IPs revealed concerning patterns:

IP Analysis Results

• Network Attribution: China Telecom network
• Geographic Location: Jiangsu Province, China
• Network Range: 49.64.0.0 - 49.95.255.255
• Contact Information:
  • Abuse Contact: anti-spam@chinatelecom.cn
  • Technical Contact: jsipmanager@163.com

The analysis indicates unauthorized use of the domain for sending emails, potentially compromising domain reputation and security.

Comprehensive Protection Strategies

Here are detailed steps to protect domains, especially those not actively used for email:

1. SPF Record Configuration

Record Type: TXT
Host Name: @
Content: v=spf1 -all

This configuration prevents all email sending from the domain.

2. DMARC Policy Implementation

Record Type: TXT
Host Name: _dmarc.(domain-name)
Content: v=DMARC1; p=reject; rua=mailto:your-email@example.com

This setting rejects emails failing SPF and DKIM authentication and sends reports to your email.

3. Additional Security Measures

1. DKIM Configuration (optional but recommended)
2. Deactivation of Mail Servers
3. Regular Monitoring through DMARC Reports
4. Domain Registration Maintenance
5. Registrar Lock Implementation

Technical Implementation Guidelines

1. Access DNS Records through your domain registrar or DNS hosting provider
2. Add necessary TXT records for SPF and DMARC
3. Allow 24-48 hours for DNS propagation
4. Verify settings using online SPF/DMARC checker tools
5. Monitor DMARC reports for unauthorized use

Conclusion

This analysis reveals the critical importance of domain security and email authentication. Even domains not actively used for email communication can be targets for spoofing attempts. Implementing proper security measures through SPF, DKIM, and DMARC is essential for protecting domain reputation and preventing unauthorized use.

Regular monitoring and maintenance of these security measures ensure continued protection against evolving email spoofing threats. The investment in proper domain security contributes not only to individual domain protection but also to the overall security of email communication on the Internet.

Technical References

• DMARC Official Documentation
• SPF Record Syntax
• DKIM Protocol Specification