Email and DNS Security: DMARC Enforcement, Anti-Phishing, and Protective DNS

Section 1 / 3

Zafiyet (Vulnerability)

Tehdit bağlamı, zafiyet ve istismar senaryosu

> Purpose and scope. This article is for email/security administrators seeking to harden email and DNS infrastructure. The threat is addressed from a defensive perspective.

> Scope: Corporate email (M365/Google Workspace/on-prem) and owned domains.

Root problem: email and DNS are the front door of attacks

Phishing and BEC (business email compromise) are the most common initial access and fraud vectors. Even with SPF/DKIM configured, without DMARC enforcement an attacker can impersonate the domain; if automatic forwarding is open, a compromised mailbox silently exfiltrates; without DNS protection, users are redirected to malicious domains and domain transfer/registrar attacks steal the brand.

The fundamentals of email authentication are covered in depth in: Email Authentication: SPF, DKIM, DMARC; phishing vector: Phishing and Initial Access.

Section 2 / 3

Prevention & Hardening

Savunma teknolojileri, policy ve sertleştirme

Executive Summary

Three axes: (a) configuration (DMARC enforcement, blocking automatic forwarding, DNS records), (b) security features (secure email gateway/sandbox, protective DNS, DNSSEC, registrar lock), (c) visibility (DMARC reports and forwarding email/DNS events to SIEM).

DMARC enforcement (on top of SPF/DKIM)

SPF and DKIM alone do not enforce policy; DMARC specifies what to do with non-compliant messages:

Gradual transition: p=none (observation) → p=quarantine → p=reject. Analyze reports (RUA) to align legitimate senders and move to rejection.
DKIM signed on all legitimate flows; SPF records narrow and accurate.

MTA-STS, TLS-RPT, and BIMI

MTA-STS + TLS-RPT: Enforces TLS delivery of inbound mail; reduces downgrade/MiTM.
BIMI: Brand logo with DMARC reject (additional verification incentive). Related mitigation: Email Security Gateway with Anti-Phishing.

Secure email gateway and anti-phishing

Safe Links / Safe Attachments (URL rewriting + sandbox detonation).
Impersonation/anti-spoof protection (executive/brand impersonation), spoof intelligence.
Block automatic external forwarding (silent exfiltration from compromised mailbox). Related mitigation: Restrict Web-Based Content.

DNS security

Protective DNS (PDNS): Block resolution to malicious/command-and-control domains (C2/phishing reduction).
DNSSEC: Resolution integrity (reducing forged responses/cache poisoning).
Registrar/registry lock + DNS account MFA: Against domain transfer/DNS hijacking. Related mitigation: DNS and Domain Security.

Three axes — summary

(a) Configuration: DMARC p=reject journey, SPF/DKIM alignment, block automatic forwarding, DNS records.
(b) Security feature: Safe Links/Attachments, anti-impersonation, PDNS, DNSSEC, MTA-STS, registrar lock.
(c) Log/SIEM: Forward DMARC RUA reports + email/DNS events to SIEM.

Logging and SIEM forwarding

Use DMARC aggregate reports (RUA) to see spoofing attempts and shadow senders; forward email gateway detection events and PDNS blocks to SIEM (phishing campaign correlation). Method: Centralized Log Management and SIEM.

Pitfalls

Leaving DMARC at p=none (policy not enforced).
Leaving automatic external forwarding open.
Thinking only about the owned domain and skipping cousin-domain (lookalike) monitoring.
Leaving DNS account/registrar without MFA.

Baseline: Email & DNS Security Baseline. User side: User Training.

Section 3 / 3

Detection

Davranış, loglama ve detection kuralları

1. Spoofing and phishing

Increase in senders impersonating your domain in DMARC reports.
Anti-impersonation triggers (executive/brand impersonation); newly registered lookalike domains.

2. Compromised mailbox indicators

Creation of a new automatic external forwarding rule → BEC/exfiltration indicator.
Unusual sending volume/time.

3. DNS anomaly

Resolution attempt to a malicious domain in PDNS → infected host.
DNS record/registrar change (critical if unauthorized).

# Use-case examples (conceptual)
- New inbox rule: auto-forward to external address     → BEC/exfiltration
- DMARC RUA: domain sending from unauthorized source → spoofing
- PDNS block: known C2/phishing domain                → infection

Phishing context: Phishing and Initial Access.

Public references

RFC 7489 (DMARC), RFC 7208 (SPF), RFC 6376 (DKIM), RFC 8461 (MTA-STS).
Microsoft Learn — Anti-phishing, Safe Links, Safe Attachments; Stop auto-forwarding.
CISA — Protective DNS and email authentication guides.
ICANN / registrar — Registry/Registrar Lock, DNSSEC.
MITRE ATT&CK — M1054, M1021 (defensive context).