DMARC and Email Aut hent icat ion Updat e

Steven M J ones
Senior Systems Engineer, LinkedIn
Executive Director, DMARC.org
http://linkedin.com/in/stevenmjones

Topics• Standards and Protocols Update• Government Policy Update• Use and Adoption Update

Standards and Protocols

Standards and Protocols Update• New cryptographic guidelines for DKIM
• Developments with the ARC protocol• DMARC, Organizational Domains, and Registrars

Changes in DKIM Cryptography (RFC 8301)• RFC 4871 allowed SHA-1 and SHA-256 hashes in 2007
• SHA-1 hash has issues (RFC 6194)

and must not be used
• Minimum RSAkey length increased

to 1,024 bits
• Receivers must support key lengths

of 1,024 – 4,096 bits; larger optional

Changes in DKIM Cryptography (RFC 8463)• RSAalgorithm is being deprecatedunder RFC 8017
• Elliptic Curve signing algorithm

standardized under RFC 8031
• DKIMmay now use PureEdDSAvariant

Ed25519• Smaller keys for equivalent strengthComparing DKIM Keys
• DKIMkey record for 2,048 bit RSAkey
test._domainkey.football.example.com. IN TXT ("v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDkHlOQoBTzWR”"iGs5V6NpP3idY6Wk08a5qhdR6wy5bdOKb2jLQiY/J16JYi0Qvx/byYzCNb3W91y3FutAC”"DfzwQ/BC/e/8uBsCR+yz1Lxj+PL6lHvqMKrM3rG4hstT5QjvHO9PzoxZyVYLzBfO2EeC3”"Ip3G+2kryOTIKT+l/K4w3QIDAQAB” )• DKIMkey record for 256 bit Ed25519 key
brisbane._domainkey.football.example.com. IN TXT ("v=DKIM1; k=ed25519; p=11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo=” )Comparing DKIM Signatures
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=football.example.com; i=@football.example.com;
q=dns/txt; s=test; t=1528637909; h=from : to : subject :date : message-id : from : subject : date;bh=2jUSOH9NhtVGCQWNr9BrIAPreKQjO6Sn7XIkfJVOzv8=;
b=F45dVWDfMbQDGHJFlXUNB2HKfbCeLRyhDXgFpEL8GwpsRe0IeIixNTe3
DhCVlUrSjV4BwcVcOF6+FF3Zo9Rpo1tFOeS9mPYQTnGdaSGsgeefOsk2Jz
dA+L10TeYt9BgDfQNZtKdN1WO//KgIqXP7OdEFE4LjFYNcUxZQ4FADY+8=
DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed;
d=football.example.com; i=@football.example.com; q=dns/txt;
s=brisbane; t=1528637909; h=from : to : subject : date :message-id : from : subject : date;bh=2jUSOH9NhtVGCQWNr9BrIAPreKQjO6Sn7XIkfJVOzv8=;
b=/gCrinpcQOoIfuHNQIbq4pgh9kyIK3AQUdt9OdqQehSwhEIug4D11Bus
Fa3bT3FY5OsU7ZbnKELq+eXdp1Q1Dw==

DKIM signatureusing 2,048 bit RSADKIM signature fora 256 bit Ed25519

ARC Protocol• ARC assists with authentication ofindirect mailflows• ARC Protocol in review for publication• Some feedback from IETF leadership• On track for publication and RFC

number assignment

ARC Protocol• Recent changes to the protocol• Draft 18: Clarification of handlinginvalid chains – lowers overhead• Draft 19: Sample messages added,

minor corrections• Draft 20: Correct the status of the ARC

header fields

ARC Protocol• Additional ARC documents in IETF DMARC working group• ietf-draft-dmarc-arc-multi• How to allow multiple signing algorithms• Needed to allow adoption of Elliptical Curve (Ed25519)• ietf-draft-dmarc-arc-usage• How receivers and intermediaries can/should use ARC

ARC Protocol• OpenARC(FOSS reference implementation) nearing v1.0
• Many packages/vendors implementing ARC• GMail and Google Groups the largest service• Testing exercise held in New York in OctoberDMARC, Top-Level Domains, and Registrars• Allow for DMARC to be applied at ccTLD, like .uk or .jp• Also cover intermediate domains, ex. gov.uk• Allow TLDs to have a DMARC policy for non-existentdomains, like .bank or .insurance• These TLDs require all registrants to publish DMARC• Non-existent domains leave a gap in protection• New proposal presented at M3AAWG 44 (Brooklyn, NY)Things That (Do Not) Depend on DMARC• Yahoo Japan displays logos withauthenticated messages• Authentication method is DKIM
• Relies on private registry• Perhaps similar to service by 1&1 / GMX.de in Germany

Things That Depend on DMARC• Brand Indicators for Message

Identification (BIMI)

BIMI?

BIMI• Brand Indicators for Message

Identification (BIMI)• Email services (ex. Yahoo US) or programs (ex. Outlook)would show company logo with messages• Relies on DMARC and third parties known

as Mark Verifying Authorities (MVA)• Trial running with Yahoo US

https://www.brandindicators.org

Government Policy Update

Government Policy Update• Dutch Government• United States Federal Government• United Kingdom GovernmentDutch Government Policy• Early adopter of email authentication• DKIMrequired in 2015
• DMARC required in 2017

• April 2018: Strict DMARC and SPFpolicies required for all agencies
by the end of 2019

US Government Policy• Binding Operational Directive 18-01th• Agencies must have DMARC “p=reject” by Oct 16 , 2018

• October 2017: 18-20% have a DMARC policy• October 2018: 74-85% have a DMARC policy• 60-74% are fully compliant, with a DMARC reject policy

Different statistics provided by different vendor surveys

UK Government Policy• UK NCSC sets direction for government agencies• Improving security from national to local gov’t agencies• Set example for private companies to follow• DMARC: 4.5MMmessages/month blocked in first year
https://www.ncsc.gov.uk/information/active-cyber-defence-one-year• Mail Check tools released as open source
https://github.com/ukncsc/mail-check

Use and Adoption Update

Use of DMARC – ROI Study• Global Cyber Alliance study of Business

Email Compromise (BEC)• Tracking 1,046 organizations with“quarantine” or “reject” policies• Conservative estimate that thesecompanies avoided US$19Mfor the year
• More aggressive assumptions, $66M

Growth of DMARC Adoption Globally – 3Q 2017
Total DMARC Records and % Change by Month140%August 2017 200,000~194,000
180,000

120%
160,000
100%

140,000
120,000

80%

100,000
60%

80,00060,00040%

40,00020%
20,0000%0% change

Total Records

Data provided by Farsight Security
Graph © 2017 Trusted Domain ProjectGrowth of DMARC Adoption Globally – 2Q 2018
Total DMARC Records and % Change by Month

June 2018342,368 350,000

1.4

400,000

1.2

300,000

1250,0000.8
200,000
0.6
150,000
0.4

100,000

0.2

50,00000% Change

Total Records
Data provided by Farsight Security
Graph © 2018 Trusted Domain ProjectActive DMARC Records in Euro ccTLDs - 3Q 2017United Kingdom
Netherlands
Italy
France.EUSpain
Germany
0

1,000

2,000

3,000

4,000

5,000

6,000

7,000

8,000

Data provided by Farsight Security
Graph © 2017 Trusted Domain ProjectActive DMARC Records in Euro ccTLDs – 2Q 2018
United Kingdom
Netherlands
Italy
France.EU
Spain
Germany0

2,000

4,0006,0008,000

10,00012,000

Data provided by Farsight Security
Graph © 2018 Trusted Domain ProjectActive DMARC Records in European ccTLDs – 3Q 2017
8,000
7,000

Germany

Spain.EU

France

Italy

Netherlands

United Kingdom

6,000
5,0004,000
3,0002,000
1,0000

Data provided by Farsight SecurityGraph © 2017 Trusted Domain ProjectActive DMARC Records in European ccTLDs – 2Q 2018
12,000Germany

Spain.EUFranceItaly

Netherlands

United Kingdom

10,000
8,000
6,000
4,000
2,0000

Data provided by Farsight Security
Graph © 2018 Trusted Domain ProjectActive DMARC Records in Asia ccTLDs – 3Q 2017vnnz
jpinidhkcn
au
0200

400600

800

1,000

1,200

1,400

1,600

Data provided by Farsight Security
Graph © 2017 Trusted Domain ProjectActive DMARC Records in Asia ccTLDs – 2Q 2018
Vietnam
New ZealandJapanIndia
Indonesia
ChinaAustralia
0500

1,000

1,500

2,000

2,5003,000

Data provided by Farsight Security
Graph © 2018 Trusted Domain ProjectActive DMARC Records in Asian ccTLDs – 3Q 2017
1,600
1,400

Australia

China

Indonesia

India

JapanVietnam

1,200
1,000800600
4002000

Data provided by Farsight Security
Graph © 2017 Trusted Domain ProjectActive DMARC Records in Asian ccTLDs – 2Q 2018
3,000
Australia

China

Indonesia

India

JapanNew ZealandVietnam

2,500
2,000
1,500
1,0005000

Data provided by Farsight Security
Graph © 2018 Trusted Domain Project

Q &AありがとうございましたThank youSpeaker• Engineer at Sendmail, Inc.
• IT Architect for 10 years at Bank of America• Regular attendee at M3AAWG Meetings• Part of original DMARC industry group• Executive Director of DMARC.org since 2015
• Joined LinkedIn Postmaster Team in 2017

http://linkedin.com/in/stevenmjones• LinkedIn also part of original DMARC groupReferences &Resources

Resources – UK Policies
Fe brua ry 2018: Active Cyber Defence - One Year On
https://www.ncs c.gov.uk/information/active -cybe r-de fence -one -ye a r

Nove mbe r 2016: £1.9 billion national cybe r se curity strategy
https://www.ncs c.gov.uk/blog-post/active -cybe r-de fence -tackling-cybe r-attacks -uk

Octobe r 2016: National Cybe r Se curity Ce ntre plans to create das hboa rd showing
gove rnme nt depa rtment adoption of DMARC
https://www.publictechnology.net/articles/ne ws/national-cybe r-s e curity-ce ntre-publish-rankings -de pa rtmentalema il-s e curity

S e ptembe r2016: NCS C Chief outlines ne w, active approa ch
https://www.ncs c.gov.uk/news/ne w-a pproa ch-cybe r-s e curity-uk

June 2016: Ca binet Office re quires DMARC & HTTP STS by Oct 1st
https://gdste chnology.blog.gov.uk/2016/06/28/updating-our-s e curity-guidelines -for-digital-se rvice s/

Resources – US Policies
Octobe r 2017: DHS Is s ue s Binding Ope rational Directive 18 (BOD-18) re :DMARC, HTTP S
https://cybe r.dhs .gov/
https://www.infos e curity-ma ga zine .com/news/dhs -ma ndates -dma rc-https/
July 2017: US Se nator Ron Wyde n’s Letter to DHS
https://www.wyde n.s e nate.gov/downloa d/letter-to-dhs -rega rding-dma rc
Ma rch 2017: FTC - ”Us e Ema il Authe ntication”
https://www.ftc.gov/news -e ve nts/blogs/bus ines s -blog/2017/03/want-stop-phishe rsus e -e mail-a uthe ntication
April 2016: NIS T Spe cial Publication 800-177: Trustworthy Emailhttps://cs rc.nist.gov/pres e ntations/2016/nist-s p-800-177-trustworthy-e mail

Resources – Dutch and German Policies
Dutch gove rnme nt age ncie s must ha ve strict DMARC & SP F policie s by end of 2019
April 2018: https://www.forumstanda a rdisatie.nl/nieuws/nieuwe -a doptiea fspraa k-voor-informatieve ilighe idstanda a rden

Ge rma n BS I re comme nds DMARC
https://www.a llianz-fue r-cybe rsiche rheit.de/ACS/DE/_downloads/techniker/netzwe rk/BS I-CS -098.html

e co.de / Ce rtified Se nde rs Alliance : DMARC is compatible with Ge rma ny’s fe de ral
a nd state data priva cy la ws
https://e-ma il.e co.de/wp-content/blogs .dir/26/files/eco_dma rc_legal_report.pdf

e co.de / Ce rtified Se nde rs Alliance : Me mbe rs re quired to adopt strong a uthe ntication(DMARC)
https://ce rtified-s e nde rs.e u/wp-content/uploads/2016/09/Ma rketing-Directive .pdf