Once upon a time you were expecting an important email from a friend or a company you were dealing with. While it was crucial and highly time sensitive, it unfortunately went directly to your spam folder and it took you hours to realize it. You can even be happy you did.
Since the dawn of the internet’s email, spams are a nightmare to deal with on a daily basis. The impact on the overall Internet traffic was so huge that technologies and standards have been developed to specifically prevent this burden. Amongst those, one of the easiest to implement and yet very efficient is called SPF, Sender Policy Framework.
Basically, SPF is a way to inform mail servers on the Internet about the legit servers from which the emails from your Internet domain are supposed to come. For IT guys, it is easy to configure as it is just an additional entry to your DNS records stating the name or IP addresses of the mail servers you are using to send your emails.
I will skip the technical details as you can find all the information you need on Wikipedia (https://en.wikipedia.org/wiki/Sender_Policy_Framework) and as I will soon write another article on the subject to provide a few guidelines on how to mitigate this risk, as this is a risk for your companies.
Put you in an entrepreneur shoes and think about it. Nowadays, emails are one of the most used communication mean between customers and suppliers. If your emails are going into the spam folders even one time out of ten, you might lose customers. As spams are a plague for email services, most companies, and even more ISPs, have implemented strong anti-spam technologies. Amongst these, checking SPF record is likely number one. If you have a Gmail or an Outlook account, they use SPF, DKIM or DMARC (I’ll come back to these standards in the next article) to prevent spam and to ensure their messages are reaching their destination. So we would expect large corporation do the same to ensure their communication reach their goal.
As I discovered that some of our clients (amongst which some large enterprises) forgot to implement SPF, I was wondering how often this happen in a larger sample of large companies. Hence, I decided to write a little Python script to check SPF and DMARC records for the Fortune 500 Internet domains.
To keep it simple, I fed the program with the 2015’s list of Fortune 500 companies and their website and checked whether there was mail servers defines to receive email and if there was a SPF or DMARC record existing in their DNS. Here are the results:
Out of the 500 companies, I removed 39 from the statistics as there was no email server defined to receive emails. It is likely that these companies (or groups) use other domain names to send and receive external emails. On the 461 remaining companies, 333 (72,27%) have a SPF record in their DNS. Meaning 27,77% do not use it. Amongst the Top 500 companies, with Billions of $ in revenue and huge IT and risk management department, this really doesn’t make sense. Even more when we know the cost of such measure: maximum 1 or 2 hours of work for one person. Finding a better quick-win than this one will be a challenge.
One of the possible explanations might be that large companies have often complex structures with dissolved responsibilities and use heavy risk management and security framework in which such little “details” are often not mentioned as they are not considered as a risk for the sacro-saint Confidentiality, Integrity and Availability triad. While, from my point of view, and I guess you will share it, anything that might prevent the company to achieve its objectives must be considered as a risk, even if it doesn’t fit into the model. Everything must come from the business strategy and its processes. One of the biggest challenges in risk management is to keep the alignment between the business processes, their risks and the technical measures implemented.
Conclusion, if your company hasn’t define its SPF record, you know what you have to do and, on a larger picture, don’t trust the framework and the checklists. They are useful but they aren’t tailored for your business so they will miss some important risks. The best level of security are achieved when there is a good communication between the business and the supporting department and that everyone share the same goal, is empowered and understand how the business is done.
The excel sheet with the results is available here: SPF-survey
You must be logged in to post a comment.