Professional tools to analyze and protect your email with DMARC, MTA-STS, BIMI, SPF, DKIM and more.

DMARC solves the problem of fraudulent and spam emails impersonating your domain and reaching your customers' inboxes, thus protecting your company's reputation and brand. However, DMARC does not reduce the amount of spam you receive in your own inbox; for that, you need a spam detection system. Also, DMARC does not stop all types of phishing attacks, especially those using "lookalike" domains instead of directly spoofing yours. For example, it will protect against fake "mybank.com" emails, but not "mnybank.com".

BIMI (Brand Indicators for Message Identification) is an email authentication standard that allows your organization's logo to appear next to authenticated emails in compatible inboxes.BIMI is not a standalone security protocol, but a visual layer that relies on DMARC, SPF, and DKIM implementation.To enable BIMI, you need a DMARC policy set to "quarantine" or "reject", publish your logo online in SVG Tiny 1.2 format, and create a DNS TXT record pointing to the logo URL and, optionally, a Verified Mark Certificate(VMC) or Certification Mark(CMC).BIMI enhances brand visibility, strengthens recipient trust, and helps prevent impersonation.

MTA-STS (Mail Transfer Agent Strict Transport Security) is a security protocol that allows mail servers to enforce TLS (Transport Layer Security) encryption and certificate validation when sending emails to other servers that support the protocol. Traditionally, SMTP (Simple Mail Transfer Protocol) used opportunistic encryption, meaning emails could be sent unencrypted if TLS was not available. MTA-STS enforces TLS encryption and provides a mechanism for sending servers to reject delivery to servers lacking TLS support or trusted certificates, thus preventing Man-in-the-Middle attacks and DNS tampering.

MTA-STS and TLS-RPT (SMTP TLS Reporting) are complementary protocols that work together to strengthen email security. MTA-STS ensures the sending Mail Transfer Agent (MTA) must use TLS for delivery and reject emails if encryption fails, while TLS-RPT helps detect and report encryption issues. When a TLS link fails, a TLS report in JSON format is generated and sent to the email address specified in the domain owner's TLS- RPT DNS TXT record.This allows domain owners to monitor and troubleshoot email encryption issues, such as certificate or MTA - STS policy problems.

Despite its benefits, MTA-STS-TLS has some limitations. First, it only applies to the connection between mail servers, not between mail clients and servers; users still need other security measures for their emails. Second, it depends on the availability and integrity of the DNS and web servers hosting the policy, which can affect delivery if these are compromised or misconfigured. Third, it does not prevent mail servers from accepting or sending emails that do not comply with the policy; therefore, it is crucial to combine it with other security mechanisms like SPF, DKIM, and DMARC to verify sender and recipient identity and authenticity.

To configure DMARC, you must first set up SPF and DKIM records in your DNS. SPF: Create a TXT entry in your domain's DNS specifying authorized mail servers (e.g., v = spf1 ip4: xxx.xxx.xxx.xxx - all). DKIM: Generate a pair of cryptographic keys(public and private).The private key is kept on your mail server to sign outgoing messages, and the public key is published as a TXT record in your DNS under a DKIM selector. DMARC: Once SPF and DKIM are set up, publish a TXT record in your DNS.This record includes the DMARC version(v = DMARC1), the policy you want to apply(p = none, p = quarantine, or p = reject), and an email address to receive reports(rua = mailto: your_email@example.com).It is recommended to start with p = none for monitoring and then move to stricter policies. TLS - RPT: To set up TLS - RPT, generate a TLS - RPT record(often with a record generator) and publish it in your DNS, specifying one or more email addresses to receive encryption failure reports in JSON format. Continuous monitoring of DMARC and TLS - RPT reports is essential to identify and resolve issues, maintain sender reputation, and ensure email deliverability.