4.3 Modify enterprise capabilities
📘CompTIA Security+ (SY0-701)
Email Security
Email is one of the most common ways attackers try to compromise organizations. To protect enterprise email, companies implement standards and tools that verify email authenticity, prevent phishing, and block malicious content. The key parts you need to know for the exam are SPF, DKIM, DMARC, and email gateways.
1. SPF (Sender Policy Framework)
What it is:
SPF is a way for a domain owner to specify which email servers are allowed to send emails on behalf of their domain.
How it works:
- A domain owner publishes an SPF record in their DNS (Domain Name System).
- This record lists the IP addresses or servers that are allowed to send emails from that domain.
- When an email is received, the recipient server checks the SPF record. If the email comes from a server not listed, it might be flagged as spoofed.
Example in IT terms:
- Domain
company.comonly wantsmail.company.comto send emails. They create an SPF DNS record listing this server. - If an attacker tries to send fake emails from
company.comusing another server, SPF helps the recipient detect it.
Key point for the exam:
- SPF protects against email spoofing.
- It’s DNS-based.
- SPF alone does not encrypt or validate email content—it only checks the sending server.
2. DKIM (DomainKeys Identified Mail)
What it is:
DKIM adds a digital signature to an email. It allows the recipient to verify that the email was not altered in transit and is really from the claimed domain.
How it works:
- The sender’s mail server adds a DKIM signature to the email header. This is a cryptographic hash of the message content.
- The public key for verification is published in the sender’s DNS.
- The recipient’s mail server uses the public key to verify the signature. If the email content was tampered with, verification fails.
Example in IT terms:
- A marketing email is sent from
marketing.company.com. - DKIM ensures the message content hasn’t been changed by hackers while traveling over the internet.
Key points for the exam:
- DKIM protects integrity and authenticity of the email.
- It works with public/private key cryptography.
- Even if the email passes SPF, DKIM adds another layer of trust.
3. DMARC (Domain-based Message Authentication, Reporting, and Conformance)
What it is:
DMARC builds on SPF and DKIM. It tells receiving mail servers what to do if an email fails SPF or DKIM checks.
How it works:
- Domain owner publishes a DMARC DNS record.
- DMARC has policies:
none→ Just report failures, don’t block.quarantine→ Send suspicious emails to spam/junk.reject→ Block the email entirely.
- DMARC also provides reports to the domain owner about email authentication results.
Example in IT terms:
- If someone tries to send fake emails from
company.comand they fail SPF/DKIM checks, DMARC can instruct the recipient server to reject the email. - The domain owner also receives reports showing attempted spoofing activity.
Key points for the exam:
- DMARC works on top of SPF and DKIM.
- It gives policy enforcement and reporting.
- Helps prevent phishing attacks using your domain.
4. Email Gateways
What it is:
An email gateway is a security tool that filters email traffic before it reaches users’ inboxes.
How it works:
- Positioned between the internet and your internal mail servers.
- Can perform multiple security checks:
- Spam filtering
- Malware scanning
- Attachment and link scanning
- Policy enforcement (blocking certain senders, attachments, or content types)
- Works with SPF, DKIM, and DMARC to validate incoming email.
- Often logs and alerts administrators for suspicious emails.
Key points for the exam:
- Email gateways prevent attacks before they reach users.
- Can enforce security policies on email traffic.
- Often integrated with SIEM systems for monitoring.
Summary Table for Exam
| Technology | Purpose | How it Works | Key Exam Point |
|---|---|---|---|
| SPF | Verify sender server | DNS record lists allowed servers | Prevents spoofed senders |
| DKIM | Verify message integrity | Adds digital signature, checked with DNS public key | Prevents tampering |
| DMARC | Policy + reporting | Works with SPF/DKIM, defines action for failures | Helps stop phishing, provides reports |
| Email Gateway | Filter & protect emails | Scans, blocks malware/spam, enforces policies | Protects users before inbox |
Exam Tip:
- Remember: SPF = server, DKIM = message, DMARC = policy/reporting, Gateway = filter.
- DMARC requires both SPF or DKIM to function properly.
- Gateways are your first line of defense for enterprise email security.
