Downloaded 15 times
Taking the hassle out of email authentication
- 2. “Any sufficiently advancedtechnology is indistinguishable from magic.” - Arthur C. Clarke
- 3. 1. The problem 2.Why email authentication? 3. Why don’t people do email authentication? 4. Automation can fix the problem 5. Conclusion
- 4. 1. The problem 2.Why email authentication? 3. Why don’t people do email authentication? 4. Automation can fix the problem 5. Conclusion
- 5. Ruby - 4 yearsold - budgets her food Esmerelda - 6 months old - devours her food
- 6. • Ruby isa young-middle aged cat and doesn’t eat her food all at once. She comes back to it and munches about 15 times per day. • Esmerelda is young and gulps down her food, and then goes to Ruby and eats hers, too. • Esmerelda eats too much, Ruby gets too little. • How do I fix this!?
- 7. 1. The problem 2.Why email authentication? 3. Why don’t people do email authentication? 4. Automation can fix the problem 5. Conclusion
- 8. 1. SPF –path-based authentication 2. DKIM – message-based (digitally signed) authentication 3. DMARC – what you see must authenticate
- 9. 1. To stopphishing and spear phishing
- 10. 1. To stopphishing and spear phishing Spear phishing is possible because From: domain spoofing is easy to do. Office 365 has a lot of backend intelligence to stop this in the absence of SPF, DKIM, and DMARC records but the fact remains that unprotected domains leaves you open to spoofing
- 11. 2. To enablerich email scenarios
- 12. 2. To enablerich email scenarios Email clients want to give you a rich experience. This example is an agreed-upon XML standard between airlines and email clients that if they send in a certain format, the email client will “promote” the features and display them prominently. However, if you don’t authenticate your email, receivers will be wary about showing the rich content. So, your competitor’s messages will look nice in the inbox. Yours will not.
- 13. 3. Because ifyou don’t care, your email will look bad
- 14. 3. Because ifyou don’t care, your email will look bad Gmail shows an exclamation point if you don’t authenticate with SPF or DKIM. Office 365 shows a red safety tip for messages that fail authentication. Email clients will start treating unauth’ed mail suspiciously going forward, and it will only lead to a more and more degraded experience for non-authed mail. In other words, things will not get any better for unauth’ed mail.
- 15. 1. The problem 2.Why email authentication? 3. Why don’t people do email authentication? 4. Automation can fix the problem 5. Conclusion
- 17. 1. The problem 2.Why email authentication? 3. Why don’t people do email authentication? 4. Automation can fix the problem 5. Conclusion
- 19. Automatic cat feedensures Esmerelda (the young, tabbie cat) doesn’t scarf down all her food at once, feeds her 4x per day
- 20. A pet feederwith microchip ensures that only Ruby (the orange, older cat) can have access to that set of food. The feeder detects the microchip that has been paired to the cat which I had to do manually. Ruby did not cooperate while I did that.
- 21. “All happy familiesare alike; each unhappy family is unhappy in its own way.” - Leo Tolstoy, from Anna Karenina
- 22. What does thismean? Happy families do everything right – stable home, good financial situation, strong extended family, good neighborhood, and so forth. Happy families must do all of these. An unhappy family only needs one of these to go wrong. Thus, happy families need 10/10 conditions, unhappy ones need only 1/10 to be bad, and each 1/10 can be different than the next.
- 23. What does thismean for email? Email auth must do everything right – correct syntax, well maintained, understood by knowledgeable people, and so forth. It is trivially easy for email authentication to go poorly in a big organization... Or a medium-size one… or a small one. And there are many different ways for it to go wrong.
- 26. I say whereto look it up from DNS CNAME Pushing a button sets this up
- 27. I say whereto look it up from DNS CNAME Pushing a button sets this up
- 28. I say whereto look it up from DNS CNAME Pushing a button sets this up
- 29. I say whereto look it up from DNS CNAME Pushing a button sets this up
- 32. I say whereto look it up from DNS redirect, macro
- 33. I say whereto look it up from DNS redirect, macro
- 34. I say whereto look it up from DNS redirect, macro
- 35. I say whereto look it up from DNS redirect, macro
- 39. 1. Enforces compliance 2.Reduces errors 3. But… adds some additional cost to service provider 4. But… still requires some configuration for some domains
- 40. 1. Email authenticationis becoming more important 2. But it’s difficult to do 3. So, we need to automate it because that’s the only way it will work over the long run
Editor's Notes
- #2 Solid background, with 1 box highlight
- #6 Ruby is a young-middle aged cat and doesn’t eat her food all at once. She comes back to it and munches about 15 times per day. Esmerelda is young and gulps down her food, and then goes to Ruby and eats hers, too. Esmerelda eats too much, Ruby gets too little.
- #10 Spear phishing is possible because From: domain spoofing is easy to do. Office 365 has a lot of backend intelligence to stop this in the absence of SPF, DKIM, and DMARC records but the fact remains that unprotected domains leaves you open to spoofing
- #11 Spear phishing is possible because From: domain spoofing is easy to do. Office 365 has a lot of backend intelligence to stop this in the absence of SPF, DKIM, and DMARC records but the fact remains that unprotected domains leaves you open to spoofing
- #12 Email clients want to give you a rich experience. The above example is an agreed-upon XML standard between airlines and email clients that if they send in a certain format, the email client will “promote” the features and display them prominently. However, if you don’t authenticate your email, receivers will be wary about showing the rich content. So, your competitor’s messages will look nice in the inbox. Yours will not.
- #13 Email clients want to give you a rich experience. The above example is an agreed-upon XML standard between airlines and email clients that if they send in a certain format, the email client will “promote” the features and display them prominently. However, if you don’t authenticate your email, receivers will be wary about showing the rich content. So, your competitor’s messages will look nice in the inbox. Yours will not.
- #14 Gmail shows an exclamation point if you don’t authenticate with SPF or DKIM. Email clients will start treating unauth’ed mail suspiciously going forward, and it will only lead to a more and more degraded experience for non-authed mail. In other words, things will not get any better.
- #15 Gmail shows an exclamation point if you don’t authenticate with SPF or DKIM. Email clients will start treating unauth’ed mail suspiciously going forward, and it will only lead to a more and more degraded experience for non-authed mail. In other words, things will not get any better.
- #19 Automatic cat feed ensures Esmerelda doesn’t scarf down all her food at once Pet feeder with microchip ensures that only Ruby can have access to that set of food
- #20 Automatic cat feed ensures Esmerelda doesn’t scarf down all her food at once Pet feeder with microchip ensures that only Ruby can have access to that set of food
- #21 Automatic cat feed ensures Esmerelda doesn’t scarf down all her food at once Pet feeder with microchip ensures that only Ruby can have access to that set of food