Emails are still the most popular and widely used means of communication. Emails enable professional, formal, and above all, quick communication, which is indispensable for business purposes. They can be sent from almost any internet-enabled device from anywhere in the world and often offer integration options with calendar, contacts, video conferencing, or other productivity tools.

 

Currently, around 4.37 billion email users send over 361 billion emails daily worldwide. With the increasing importance of email communication, the risk of cyberattacks has also risen sharply in recent years.

 

In 2023, nearly 47% of the total global email traffic was spam emails.

 

Most spam emails, about 31.5%, are sent from Russia, followed by the USA and China with 11%.

 

Phishing or email spoofing are widespread methods used to trick potential victims into disclosing sensitive information such as passwords or credit card details through a fake sender address. The attacker pretends that the email comes from a trusted source, aiming to gain the victim's trust by pretending to be someone they are not.

 

At first glance, it is often not easy for users to recognize phishing emails and fake sender addresses. Cybercriminals go to great lengths to make the fake emails look like perfect one-to-one copies of the original. Fake sender addresses are often very similar to the actual sender addresses, with only one letter in the domain name being swapped (like l and 1 or o and 0).

 

By using shortened URLs or embedded links, users are often redirected to malicious websites by simply clicking. The displayed sender name is manipulated to differ from the actual sender. Hackers like to use well-known domain names for their criminal activities. This works relatively easily when corresponding authentication protocols like SPF, DMARC, or DKIM are missing.

 

Using an SPF record (Sender Policy Framework) can prevent sender address spoofing. The sender enters a text record in their DNS (Domain Name System), listing the IP addresses or domains authorized to send emails over the respective domain. Without a corresponding SPF record, any email server could send emails on behalf of the domain.

 

The recipient's email server checks the SPF record to determine whether the email comes from an authorized server. Many modern email servers and spam filters have SPF checks as part of their standard process to combat spam and phishing. If an SPF check fails, the receiving email server can reject the email, preventing it from being delivered.

 

Another authentication option for emails is the DKIM protocol (DomainKeys Identified Mail). For this, a private and a public key are generated. The public key is published as a DNS text record. The private key remains on the email server and is used to sign outgoing emails. This ensures that an email has not been altered and actually originates from a specific domain.

 

To combat phishing and spamming, DMARC (Domain-Based Message Authentication, Reporting and Conformance) should be used as an authentication standard in addition to the SPF record and DKIM protocol. A DMARC record is also a text record that specifies how incoming email messages should be handled that have already passed the SPF and DKIM checks. It is an additional check that decides whether an email should be returned to the sender, blocked, or marked as spam if the SPF or DKIM check fails.