Save my e-mails

What is the problem?

Email was invented in the late '80s, but since then the fundamental technical design hasn’t changed. An email is no more than a simple text file transferred over a network. That means the sender can edit every part of the email - including even the sender's name and address.

Now, most of the emails we receive today are legitimate. But in a growing number of cases, malicious individuals find it easy to exploit our trust in this medium. By sending you an email with the name and address of a fellow co-worker, client or even superior, the fraudster’s chances of you opening and reading the email are much higher.

These spoofing or “phishing” attacks are one of the biggest digital security challenges businesses face today and are responsible for some of the largest headline “hacking” cases you’ve seen in the media. This type of fraud bypasses traditional network security safeguards and seeks to compromise legitimate user credentials, thereby opening up a “back door” to your network that is notoriously difficult to defend against. Hence the crucial need for a proactive solution that stops these forged sender name and address attacks before they even reach the victim.

What is the solution?

The Sender Policy Framework (SPF) is an open internet standard that addresses this issue. The owner of a SPF record states which servers may send on behalf of that domain and what policy recipients should follow when receiving emails from unauthorized senders. If your organization owns one domain and has two mail servers, that SPF record is short and, once it’s setup, you are most likely safe.

But in the modern business world, companies operating in many countries own sometimes hundreds of domains. They likely have dozens of organizational entities, as well as external partners also sending emails on their behalf, such as newsletters, incident notifications, messages from cloud services, etc. This is the moment when SPF management becomes complicated, and makes it easier for scammers to exploit the trust users have in so many “official” message sources. At the same time though, many companies are afraid that setting the SPF policy to “reject all email if it is not sent from an authorized source” will disrupt business just as much as fraudsters. Undelivered emails are one of many nightmares of ICT support.

Naturally, opening the flood gates and allowing all emails is an invitation to disaster. Some IT departments try to find a middle ground and manage sender records hands-on, but they soon run into the infamous “maximum 10 queries limit.” Without delving too much into technical details, this specification of standard SPF limits how many external partners you can authorize to send on your behalf and many organizations reach that limit with 2 or 3 email providers.

SPF Guru to the rescue

This is where the SPF Guru comes into play. SPF Guru is a unique service with a stellar track record of helping businesses manage their SPF records through a user-friendly web interface. But that’s just the tip of the iceberg. When hosting your SPF records with the Guru, the “10 query limit” no longer applies, since we use an improved method to supply and verify the sender information. That applies regardless of whether a certain sender is authorized to send on behalf of your domain or not. Instead of having the receiving mail server gather a list of authorized IP addresses, SPF Guru has this list already pre-cached. All the recipient needs to do is query the SPF Guru. This approach is fully compatible with the open-architecture standard of the Sender Policy Framework and adhered to by millions of mail servers worldwide.

In addition to passive defense, the SPF Guru is able to actively monitor exactly who is sending emails on behalf of your domains. You won’t have to change anything in your mail workflow for this monitoring to be effective. Even when a fraudster in Asia, for example, sends a spoofed email with one of your domains as sender to someone in South America, our monitoring will take notice. By monitoring all unauthorized campaigns, you can quickly identify legitimate senders that are not yet on your list of authorized mail servers, while keeping the scammers at bay. You can even see which of your mail servers are currently being flagged as known spam senders by third parties and take immediate action to restore trust in your communications.