{"id":4640,"date":"2024-12-06T16:14:23","date_gmt":"2024-12-06T15:14:23","guid":{"rendered":"https:\/\/solidnames.fr\/dmarc-on-the-rise-while-awaiting-bimi\/"},"modified":"2024-12-06T16:14:23","modified_gmt":"2024-12-06T15:14:23","slug":"dmarc-on-the-rise-while-awaiting-bimi","status":"publish","type":"post","link":"https:\/\/solidnames.fr\/en\/dmarc-on-the-rise-while-awaiting-bimi\/","title":{"rendered":"DMARC on the rise while awaiting BIMI"},"content":{"rendered":"

Afnic has studied the adoption of SPF, DMARC, DKIM and BIMI on .FR domain names. DMARC deployment has doubled in the .FR zone compared to 2023.<\/p>\n

The SPF, DMARC and DKIM methods are essential for protecting domain names against phishing attacks<\/a> and improving e-mail deliverability.<\/p>\n

Definition of SPF, DMARC, DKIM<\/h2>\n

As a reminder, here’s what these solutions mean:<\/p>\n

SPF (Sender Policy Framework)<\/strong>: SPF is an e-mail authentication protocol that allows domain name owners toindicate which mail servers are authorized to send e-mail on their behalf<\/strong>. This helps prevent spoofing<\/a> by verifying that e-mails come from authorized sources. <\/p>\n

DKIM (DomainKeys Identified Mail)<\/strong>: DKIM adds a digital signature to outgoing e-mails<\/strong>. This signature enables the recipient to verify that the e-mail has not been altered in transit, and that it comes from the specified domain name. This reinforces message integrity and authenticity. <\/p>\n

DMARC (Domain-based Message Authentication, Reporting & Conformance)<\/strong>: DMARC combines SPF and DKIM to offer additional protection. It enables domain name owners to define policies on how unauthenticated emails should be handled<\/strong> (e.g. quarantined or rejected). DMARC also provides reports on impersonation attempts<\/a>, helping to monitor and improve e-mail security. <\/p>\n

DMARC adoption has doubled in one year among .FR domain names<\/h2>\n

Between 2023 and 2024, AFNIC’s study on the subject<\/a> found that 16.6% of domain names<\/strong> now publish a DMARC policy, compared with 7.8% in 2023<\/strong>.<\/p>\n

This is a major step forward in the space of just one year.<\/p>\n

Other entries are also on the rise, with 74.4% of .FRs with an SPF policy (versus 57.8% in 2023). In addition, 33% of .FRs have deployed DKIM, compared with 23.1% in 2023.<\/p>\n

This meteoric rise can be explained by two private initiatives by two major Internet players: Google and Yahoo.<\/p>\n

Since February 2024, senders of 5,000 or more messages per day to Gmail accounts have been required to authenticate outgoing e-mails via DMARC<\/a>.<\/p>\n

DMARC policies to apply<\/h2>\n

It’s worth pointing out that Google is not intransigent in this rule change. A simple DMARC policy of p=none is sufficient for Gmail and Yahoo. This means that in the event of unauthorized IP addresses, e-mails are still delivered. <\/p>\n

AFNIC points out that there are three possible DMARC policies.<\/p>\n

” The term p=reject in a DMARC policy means “?don’t let the message through”; the term p=none, conversely, means “?let the message through anyway” and in between is p=quarantine, which suggests quarantine, for example by storing the message in a “?junk?” subdirectory<\/strong> or queuing it for closer scrutiny.”<\/em><\/p>\n

However, the AFNIC study notes a “sharp rise in DMARC adoption, which also goes hand in hand with a clear decrease in the proportion of p=none policies, mainly in favor of p=quarantine. As for p=reject, the increase is very slight for domains publishing a website, but more significant for domains without a website. <\/em> “.<\/p>\n

\"DMARC

DMARC deployment for .FR domain names (Source : Afnic.fr)<\/p><\/div>\n

AFNIC has identified 117,243 domains publishing a p=reject. This represents 2.99% of .FR domains, more than double the figure for 2023 (1.34%).<\/strong><\/p><\/blockquote>\n

No BIMI without DMARC<\/h2>\n

DMARC’s growth can also be explained by the growing interest in BIMI (Brand Indicators for Message Identification).<\/p>\n

BIMI is a recent standard that allows companies to display their logo next to their e-mails in recipients’ inboxes.<\/strong><\/p><\/blockquote>\n

For a BIMI-supported messaging system to display the logo associated with the sender domain name, a DMARC policy is required. This must be strict, with p=quarantine or p=reject. <\/p>\n

Since 2016, Solidnames supports organizations wishing to deploy SPF, DKIM and DMARC. This IT consulting mission, called DRUIDE at Solidnames <\/a> has been performed dozens of times over the past eight years.<\/p>\n

In 2022, Solidnames implemented BIMI for its main domain solidnames.fr<\/strong>. Since then, our company has also been offering IT support to organizations wishing to adopt BIMI<\/a>. <\/p>\n

Nevertheless, the use of BIMI remains confidential in the .FR zone. According to the AFNIC 2024 study, only 58 domain names (including solidnames.fr and a few customers) have the appropriate VMC (Verified Mark Certificate) for BIMI<\/strong>.<\/p>\n

This market is shared between two American companies, DigiCert and Entrust.<\/p>\n

States increasingly demanding DMARC policy while waiting for BIMI?<\/h2>\n

However, the adoption of DMARC and BIMI can be supported by a regulatory context<\/a> that strongly encourages these uses.<\/p>\n

Back in 2017, the Trump administration ordered federal agencies to adopt common email security standards to better protect themselves against hackers in particular with DMARC<\/a>.<\/p>\n

Since then, many countries have followed this trend. In 2018, Saudi organizations were encouraged to use DKIM, SPF and DMARC as advanced phishing protection techniques to filter out fraudulent messages. <\/p>\n

In 2022, the Irish public sector will be required to use SPF, DKIM, DMARC and TLS to enhance e-mail security.<\/p>\n

The previous year saw more stringent applications. Dutch government agencies are required to implement DMARC, as well as DKIM, SPF. In Denmark, government entities must implement a DMARC policy of p=reject on all their domain names. <\/p>\n

All these initiatives demonstrate that, all over the world, the structural problem of email and the ease with which it is possible to steal an identity is being tackled head-on.<\/p>\n

Test your domain name’s SPF and DMARC compliance for free<\/h2>\n