DMARC, SPF and DKIM
Three email authentication mechanisms that prevent a fraudster from sending mail in a company's domain name, whose absence is visible from outside at underwriting.
The email protocol does not, by itself, check that a message's sender is who it claims to be. Three complementary mechanisms fill that gap. SPF publishes the list of servers authorized to send mail on behalf of a domain. DKIM applies to each message a cryptographic signature the recipient can verify. DMARC tells receiving servers what to do with a message that fails these checks, let it through, quarantine it or reject it, and sends the domain owner reports on uses of its name. Together they make direct spoofing of a domain much harder, which is used for phishing customers and for payment fraud through fake orders from an executive or supplier. For the underwriter, these settings offer a twofold benefit: they act on the frequency of a costly peril, social engineering fraud, and they can be checked from outside, simply by looking up the domain's public records, without relying on the insured's statements. They do not protect against lookalike domains, which call for other monitoring.
Since February 2024, the two main consumer email providers have required senders of more than 5,000 messages a day to publish a DMARC policy and authenticate their mail with SPF and DKIM, or have their messages rejected or marked as spam.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.