In this lesson,
we're going to discuss email security.
Email security is a critical aspect
of modern digital communication
that involves various techniques and protocols
to safeguard email content, accounts,
and infrastructure from unauthorized access,
lost or compromised.
Some of these techniques includes the configuration
of DKIM, SPF, DMARC,
email gateway protocol and spam filtering mechanism.
First, let's discuss DKIM.
DKIM or the domain keys identified mail allows the receiver
to check if the email was actually sent
by the domain it claims to be sent from,
and if the content was tampered with during transit.
DKIM works by adding a digital signature to the headers
of the email, which can then be validated
against a public cryptographic key
that is located on the domain's DNS records.
For example, if someone at diontraining.com sends an email,
the receiving server can check the DKIM signature against
diontraining.com's public key.
If the digital signature matches, this confirms
that the email is genuinely from diontraining.com
and that it hasn't been modified during transit
from our service to your email server.
DKIM can provide us with numerous benefits
like email authentication,
protection against email spoofing,
improved email deliverability,
and an enhanced reputation score.
Second, we have SPF.
SPF, or the sender policy framework,
is an email authentication method designed
to prevent forging sender addresses during email delivery.
When an SPF enabled server receives email,
it can verify the sender's IP address against a list
of authorized IPs published
in the sender's domain DNS records.
For example, if someone at diontraining.com sends an email,
the receiving email server will first check
if the IP address of the sender is listed in the SPF record
of diontraining.com before accepting it.
If the IP address is not listed
as authorized in the sender's policy framework,
then the email will be marked as spam
or it will be rejected by the email server.
Some of the benefits of implementing SPF
include preventing email spoofing,
improved email deliverability,
and enhanced domain reputation.
Third, we have D-M-A-R-C configuration, or DMARC.
DMARC or Domain-based Message Authentication, Reporting,
and Conformance is an email validation system designed
to detect and prevent email spoofing.
DMARC allows the administrative owner of a domain
to publish a policy on which mechanisms should be employed
when sending emails from that domain
and how the receiver should deal with the failures.
DMARC can work with either DKIM, SPF,
or both depending on how you configure it.
For example, a company like diontraining.com sets up
a DMARC policy that instructs receiving email service
to reject any emails that claim
to come from diontraining.com,
but have already failed the DKIM or SPF checks.
This will be a proper way to implement DMARC
in order to increase your email security.
The primary purpose of implementing DMARC is
to protect a domain from being used
in business email compromised attacks,
phishing emails, email scams,
and other cybersecurity threat activities.
In our modern enterprise networks,
every email server should be configured to use DMARC
as a minimum level of protection
against email-based scams and attacks.
Fourth, we have the configuration
of our email gateway protocol.
An email gateway is a server or a system that serves
as the entry and exit point for emails.
This gateway is then responsible for handling the transfer
of emails between the Internet and a local network.
Email gateways are crucial for ensuring the secure
and efficient transmission of emails.
Email gateways usually rely
on the simple mail transfer protocol or SMTP
to send and receive emails.
When an email is sent, it first passes through
to a sender's email gateway
before it's sent over the internet.
Once the email reaches the recipient's domain,
it will then go through the recipient's email gateway
before it's delivered to the intended recipient inbox.
Email gateways are implemented to help with email routing,
email security, policy enforcement,
and the encryption and decryption of emails.
Our organization's email gateway is primarily responsible
for routing outgoing emails to the correct destination
and directing incoming emails
to the appropriate user inboxes.
These email gateways also provide us with higher levels
of email security by helping to protect us
against threats like spam, phishing, and malware
by scanning each incoming or outgoing email
for malicious content or suspicious pattern.
We can also use our email gateways as a method
of enforcing policies that have been set forth
by our organization, such as being able
to block any outgoing emails
that might contain sensitive information,
or you could block incoming emails
from a specific or known malicious user.
In addition to all of these features,
our email gateways can provide email encryption services
by encrypting outgoing emails and decrypting income emails
to protect your organization's sensitive information.
These email gateways can be installed and configured
as either an on-premise, cloud-based,
or hybrid email gateway.
An on-premise email gateway is a physical server
that's located within the organization's own data center
or premises that provides an organization
with full control over their email system.
This gives us the most flexibility
when we opt to use the on-premise solution,
but it does require
that our system administrators maintain the system
and update it as needed over time.
A cloud-based email gateway is an email gateway
that is hosted by a third party cloud service provider
to provide us with the greatest scalability
and ease of maintenance,
but this can be more expensive
to operate than an on-premise solution,
and you'll be limited
to the cloud service provider's security measures
when determining your exact configurations.
A hybrid email gateway is used to combine the benefits
of both on-premise and cloud-based gateways
into a single offering by attempting
to achieve a good balance between more control
and more convenience.
Finally, let's quickly discuss the concept
of spam filtering.
Spam filtering is a process of detecting unwanted
and unsolicited emails and preventing them
from reaching a user's inbox.
Spam filtering usually involves various techniques
such as content analysis, Bayesian filtering,
DNS-based sinkhole list, and general email filtering rules.
For example, if an email contains words commonly associated
with spam messages like lottery, free, prize,
or other commonly used spamming languages,
then your enterprise network spam filter might flag it
as potentially being spam and move it to the spam folder.
So remember, email security can be improved
by using various techniques including the configurations
of DKIM, SPF, DMARC,
email gateway protocols, and spam filtering mechanisms.
DKIM is used to add a digital signature to the email header
that can be used to validate the recipient
and ensure that the email was not modified during transit.
SPF prevents sender address forging
by checking if the sender's IP address is authorized
in the domains DNS records.
DMARC is a protocol that uses SPF
and DKIM to determine the authenticity of the email message
by allowing a domain owner to specify
how to handle any emails that fail
that particular security check.
Email gateways serve as the entry point and exit point
for all enterprise emails.
These email gateways are implemented to help
with email routing, email security, policy enforcement,
and the encryption and decryption of emails.
And lastly, we also have spam filtering,
which is a technique to detect
and block unwanted emails based on various criteria
such as content, sender reputation and user preferences.