Setting Up Gmail Security and Deliverability

0:00Now, Google Workspace is of course a whole entire suite of productivity and

0:04collaboration tools

0:06that allow an organization to work together, to accomplish things in a much

0:10more efficient way.

0:11But one of the core products or one of the core ingredients is email, or

0:17specifically in this

0:17case, Gmail, which uses the same email protocol that has existed since almost

0:24the beginning of

0:25the internet. Now, there are a lot of protocols that were around back then that

0:29are no longer used.

0:30Things like Gopher used to be a menu-based way to get through internet-hosted

0:35stuff,

0:35and that existed before the World Wide Web. There were Archie and Veronica for

0:40searching through sites.

0:41Email, oddly enough, has stuck around this entire time, and it's still

0:46something that is central to

0:48almost every business and organization when it comes to communication. Of

0:53course, it's offset

0:54by lots of other communication tools, but email is still vital. And because of

1:00its long-ago routes,

1:03email has had to build lots of security on top of what used to be a very basic

1:11and insecure

1:12protocol. And so in this skill, we're going to cover how email has evolved and

1:17what a current

1:18modern secure email system looks like and how we can figure that inside Google

1:25Workspace.

0:00Now, this might seem a little bit silly to actually say out loud, but email has

0:05two different

0:05directions that it travels. We have outgoing email and we have incoming email.

0:10Now, the first thing

0:11that we're going to configure is incoming email, meaning that if somebody sends

0:16an email to Sean

0:17at nuggetlab.org, we need to have a way that their email client or their email

0:23server knows

0:25where to send that in order for it to get to us. Now, since we're sending up

0:29Google workspace,

0:31we need to be able to tell the rest of the internet, hey, if you want to send

0:35me an email at an

0:36address at nuggetlab.org, I need you to send it to Google's mail server and

0:42they'll see that it's

0:43coming to somebody who is paying for a Google workspace account and they will

0:47deliver it, you know,

0:49that way. The way that we tell the internet where email is supposed to go for

0:54our domain is by setting

0:56up a DNS record. And hopefully that makes sense. DNS is where our domain

1:01information is stored.

1:03And we want to tell the internet where email addressed to our domain should end

1:09up. And so

1:10we create DNS records, specifically MX records, which means mail exchange. And

1:17that MX record or

1:19those multiple MX records actually tell the internet, if you want to send email

1:24to Sean at

1:25nuggetlab.org, send it to one of these email servers. And the reason I say one

1:31of these plural

1:32is because almost always not necessarily, you can just have a single MX record

1:36and a single mail

1:37server. But that's really, really not ideal. Generally, you want to have

1:42multiple servers

1:44that will accept mail for your domain and then deliver them to you. If there's

1:49an outage between,

1:51you know, the first priority email server and the client trying to send email,

1:56or if one of them's

1:56down for maintenance, lots of various reasons, you want to always have somebody

2:01listening for email

2:04that's addressed to your domain. And basically, the their mail server, the one

2:07that is sending the

2:08email that you're trying to receive is going to look do a DNS look up and they

2:12'll look for your

2:14MX records. And the first priority one is the server they'll try first and they

2:18'll try it. And if they

2:20get in touch with that server, they'll deliver the email to that server and it

2:23'll all be done.

2:24If they try to get in touch with that server, and it doesn't respond, or there

2:28's, you know, a network

2:29cut so they can't get to it or it's down for maintenance, they'll go to the

2:32next one on the

2:33priority list and try that email server and they'll go through them all until

2:37they reach the end of

2:38the list. Now, after the end of the list is reached, if they haven't gotten

2:43through to, you know, a

2:45mail server that is going to accept mail on your behalf, then things get a

2:49little bit questionable.

2:50Usually what happens is a mail server will be polite and they'll say, all right

2:56, I'll, you know,

2:57I'll hold on to this for a little while I'll keep trying and periodically,

3:00every however often

3:02it's configured for like every hour, it'll try again. It'll go down the list

3:05and try to, you know,

3:05connect to your email server. After a while though, it's going to say, you know

3:09what,

3:10I don't think this domain has an email server that is active, you know, either

3:14it only has one

3:15MX record, I tried it and it failed multiple times, or I've tried all of the MX

3:20servers on the list,

3:21and they all failed for a certain amount of time, which is not an interesting

3:24standard. There is no

3:25like standard amount of time. Eventually, they'll either just drop the email,

3:31or most likely they

3:32will send a response to the person who originally sent that email, you know,

3:36their client and say,

3:38look, I tried, it'll say message delivery failed, I tried and I just couldn't

3:42get through. So,

3:43usually at least the sender will know that it didn't get to you, but you want

3:48to have multiple

3:49mail exchange records with multiple servers, if possible, to eliminate those

3:55failed attempts to

3:57get emailed to you. Okay, so we're going to look how to set up the MX records

4:01specifically for

4:02Google Workspace and Google walks us through that in the admin panel. So I'm

4:07here, I'm logged into

4:08admin.google.com as the as an administrator for Google Workspace. We're going

4:14to go on the left

4:15hand side, you may have to click more, like if you don't see all of these

4:18options, you may have to

4:19click more, but basically we're going down to account, and then inside account

4:26domains,

4:27specifically managed domains. So we click on there, this is going to take us to

4:32all of the

4:33domains that are connected to our Google Workspace. Now there is a test one

4:38that Google sets up by

4:39default, this, you know, test dash Google A.com. But nugget lab, this is our

4:44primary domain.

4:45And this is the one that we're going to set up. Now, you'll notice that it says

4:49it's verified,

4:49we did verify it during the installation, but it's not the Gmail part is not

4:53activated. So we're

4:54going to say activate Gmail. And this is where we could do a setup MX record,

4:59which is what we're

5:00going to do, or skip the MX record setup. And this is if you have your own

5:04external email server that

5:07is going to forward mail to Google, that's not normally how it happens.

5:12Normally you want Gmail

5:13to handle all of your email. And that's what we're going to do. So we're going

5:17to pick a setup MX

5:18record, click next, and it's going to walk us through the process. So here we

5:23'll help you set up Gmail.

5:24So all the email addresses at nugget lab.org, go to Gmail, so we're going to

5:28click continue.

5:29Activate Gmail for everyone on nugget lab. So if you have more than one user

5:36already, they may be

5:36listed here. But I'm just going to say proceed with activation because we only

5:41have the one user

5:41right now. This is where it says, we're going to use Gmail once the MX record

5:46is updated. It will

5:48sign into CloudFlare for us, but I'm going to switch to manual verification in

5:52case you are not

5:53using CloudFlare. I want to just show the what it looks like. Let's see a

5:58domain host not CloudFlare.

6:00Is there just a generic? Okay, my domain uses a different host. Click continue.

6:04I'm just doing

6:05this so I get the most generic information and we can paste it into our DNS

6:09server.

6:10Okay, so the MX record here set to default value. Priority one points to SMTP

6:18at Google.com and

6:19the TTL set it to the lowest value. Now, so what Google has done here is they

6:25have made it so we

6:26only set up a single MX record. And I know you're I know you're thinking, Sean,

6:29you just went on

6:30and on about how that's not ideal. You want to have multiple MX records that

6:35will, you know,

6:36if one goes down, well, Google here this SMTP dot Google.com. That is a front

6:43end DNS entry that

6:45on the back end points to multiple servers. And so what they've done is taken

6:50the heavy lifting

6:51off of our shoulders and they have created SMTP dot Google.com as a server,

6:57which is pointing to

6:58multiple servers on the back end. And if one goes down, the others will still

7:01get it. So if you're

7:03using Gmail, you may only have one MX record, but it's going to point to to a

7:08server, which is really

7:09a front end for multiple servers. So again, that doesn't mean that my

7:13information about having multiple

7:15MX records is not valid and very important to understand. But the reason we're

7:19not going to do

7:20it is that Google has set this up. And so it's fairly simple. Priority of one,

7:25that's a top priority.

7:26Number I said they'll go by priorities. If we only have one, the priority is

7:30one. And that's going to

7:31be there. So I'm going to now open up Cloudflare, because Cloudflare is the

7:36actual DNS host that

7:37I'm using. So anyway, here we are in Cloudflare logged into the nugget lab

7:40domain. And you'll see

7:41we have the records that I had to make to verify for Google workspace install.

7:48This is how we got

7:48our domain verified, but I need to install or set up the MX records, which will

7:53be a record.

7:54The type is going to be MX, the name, it says the default, I'm just going to

8:00use at for root,

8:02because that's what it says here use at for root. The mail server is SMTP dot,

8:09let's go over here,

8:10make sure I get it right SMTP. I'll just copy it dot Google dot com. Now

8:16capital lowercase

8:17doesn't matter in DNS, but I'll just copy exactly what they put there. The TTL,

8:22I'm just going to say

8:24the lowest is one minute and the priority they said to put as one. And this is

8:28the only one,

8:29in fact, I'll make a comment here, the only MX record required, because Google

8:37handles

8:38redundancy at on there. And there. So now that MX record is set up for the

8:44domain. All right, so

8:46if we can get rid of this, come back here, it says come back here and confirm

8:49once you have updated

8:50the code on your domain host. So I'm going to click check, and I'm going to

8:54click confirm. Now this

8:55is probably going to take a while to propagate. Oh, and look at that, it's

8:59already propagated. Good.

9:00So it says we verified and Gmail is now ready. So click done. All right,

9:05verified and Gmail

9:07activated. So now if we send an email to admin at nuggetlab.org, we should

9:13receive it in Gmail.

9:15So if I click this and then I go to Gmail, so here is just the standard stuff.

9:21But if we send an email,

9:23I'll do that in from another account real quick, in another window, and we

9:26should receive that email.

9:28And boom, there we go. Sean Powers test from personal account looks like yes,

9:33we got an account,

9:34or we got the email that I sent from an external account to admin and nuggetlab

9:39.org and it arrived.

9:40So we can tell from this that the MX record single is set up and is working.

9:46That's all there is for

9:47incoming email to be configured. Now the spam filtering is all handled by

9:54Google in their

9:55servers. We don't have to configure anything to get the Google spam filtering,

10:00which is honestly

10:01really good spam filtering. So as far as incoming email, that's all set now.

10:05Outgoing email is where

10:07things get a little more complicated. And there's a handful of protocols and

10:11tools that we can use

10:12to make sure that other sites don't see us as spam when we send email.

0:00Now, the first line of defense against lots of spam coming from your domain is

0:06to set up an SPF

0:08record. Now SPF stands for sender policy framework. And that's not terribly

0:12clear by definition alone.

0:14So basically, what happens is when you have an MX record, it says where email

0:21goes to, right,

0:22when people are trying to send email to you, they look up your MX record. And

0:26the MX record says where

0:27it is supposed to go to, when people receive email from you, they look up your

0:34SPF record to see where

0:36email should be coming from. And that's where you specify what email servers

0:42are allowed to send email

0:45that is coming from you. Now, this could be multiple email servers. You could

0:50have like,

0:51you could have an email server, you know, in the house, you could have like

0:55another redundant server

0:57or a server in another, you know, part of the country, or you could be using

1:01multiple services,

1:02like Amazon Web Services uses a specific email server to send email out. But

1:09then for personal

1:10email, it's another it can be complex. But the SPF record tells people when

1:16they receive an email

1:18from you, if it, you know, they can look to see where it came from. And then

1:22they look up on your

1:23SPF record to see if that's one of the places it's allowed to come from. Now

1:27this is a text record,

1:28or a TXT record that we're going to have to put into our DNS server. But the

1:33format,

1:33it can be confusing, but it's not really too bad. Okay, so let's look at that.

1:39This is, remember, it's a text record, and we're going to put three fields in.

1:46Now, the fields are

1:46just separated by a space. The first field, and this is required, we have to

1:51have this field,

1:52is what version of SPF we're using and secret is I've never seen anything but

1:59SPF one. So v equals

2:01SPF one. I don't think we've ever gotten past SPF one I've never seen anything

2:06else out there. So

2:07it still has to be in there. The first field is the version field and just v

2:13equals SPF one

2:14space. And then the second part is how we define which servers are allowed to

2:21send email. Now,

2:22there's a there's multiple ways that we can define what servers are allowed.

2:26You can do it by IP

2:28address. So you can say IP for colon, and then you put a specific IP address.

2:34And if you are using

2:35one specific IP address as your email server, and that's always going to be the

2:41server that is

2:42sending out email on your behalf, you could do this. If you have, as Google

2:48does, multiple email

2:50servers that may change their address over time, the more common thing is to

2:56use and include

2:57value here. So include, and then a colon, and then the domain that email is

3:04going to be coming

3:06from. Okay, so this is generally how the bulk of SPF records are formed using

3:14the include,

3:15because that allows you to use a domain instead of a specific IP address. Again

3:20, so if it changes,

3:21or if there are multiple IP addresses that are connected to a specific DNS name

3:27, using include

3:29allows you to use that DNS name. And then as long as the address that the email

3:36is sent from

3:37is, you know, resolves to the domain that you say, then everything is all set,

3:42you know, it's okay,

3:44because it's included in what domains are allowed to send email on behalf of

3:51your domain. And then

3:52the last field is the word all, but it is either preceded by another's a couple

3:57other ones. But

3:58the general to that you'll see is it's either preceded by the tilde, which is

4:01that little squiggly

4:02line, or a dash. Now, these are very different in what they mean. Tilda is

4:07almost always what's

4:09recommended. It's what Google recommends. It's what I personally recommend.

4:12What this means is,

4:13if it doesn't pass SPF, right? So it's coming from an IP or domain that is not

4:20listed. It's called a

4:22soft fail that little tilde signifies all of the email will fail SPF check, but

4:29it's a soft fail.

4:30We're saying like, it didn't pass, but I'm not saying you should throw it away.

4:33It might be

4:34valid. We may have a configuration error. Now, if you do dash or just a hyphen,

4:39all, no space here,

4:41this means, okay, I have my configuration right if you're getting an email from

4:46me,

4:46everything that doesn't pass SPF should be deleted. Now, it's up to the mail

4:52server, whether or not

4:54they do delete it, but this is kind of our recommendation to them saying, okay,

4:58my configuration's right.

5:01If you're getting an email from something that is not this domain or not the IP

5:05that I specified,

5:06it's spam, you should delete it. Whereas with the tilde, which is the

5:10recommended one is,

5:12as far as I know, everything is hunky dory on my end. So you should be getting

5:18proper SPF

5:19verified emails. So even if it's bad, you should probably keep it, but maybe

5:26market is spam and

5:27deliberate flagged is spam. Whereas the dash says, just get rid of it. That's

5:31bad. All right. So

5:33generally, this is what we do because sometimes configuration errors just

5:36happen, right? And so

5:38anyway, that's the general format for an SPF record. And Google has, I'm going

5:43to put a link

5:44right below this video. Google has the ideal SPF record that you should add to

5:49your domain

5:50in order to make it work with Google workspace. And this is the link, I mean, I

5:56included the link

5:57on the on the skill, but basically, if we're using Google's workspace only,

6:01which is what we're doing,

6:03this is what the record should look like. VS or V equals SPF one space include

6:09colon underscore

6:10SPF dot Google dot com space tilde squiggly all. Okay, I'm going to copy this.

6:16So I'm going to copy

6:17that again, that link is in the skill. And then if we come back here, again,

6:21this is my DNS or

6:22cloud flare, we're going to add a text record this time. So it's a TXT record.

6:30The domain again is

6:32at for root, because this is root level email, right, anything coming to the

6:37root level nuggetlab.org

6:38is what we want this to be, you know, specified for under do TTL, the lowest

6:44one, the content,

6:46this is what I just copied. So I'm going to paste in, and it's v equals SPF one

6:50space include colon

6:52underscore SPF dot Google dot com space tilde all. All right, so this is the

6:57record. Now,

6:58just going to click save. Now you can see we have this text record, which is

7:03the SPF record for

7:05the domain. Now it might take a little bit for this to propagate as well, not

7:09too long. And I'm

7:10going to wait until we do the other things on here. And we'll test all of the

7:15stuff that we've put

7:16in at the very end by sending an email. And then on the other end to see how

7:21how it passed if it passed

7:23SPF. And then the next thing which we're going to look at because with SPF, it

7:28is certainly possible

7:30to spoof, right? We could spoof an IP address or we could spoof a DNS entry

7:36like do man in the

7:37middle DNS stuff where it could look up the address and then have one, you know

7:43, a bogus IP listed. So

7:45it might pass SPF, but still be spam. So SPF is not the only level of

7:51protection that we're offering

7:53when we send out emails in a properly configured email system.

0:00Now SPF is a great way that you can tell anybody receiving an email from you

0:05what server

0:06it should be coming from or a list of servers that are okay for email to come

0:13from when it comes from

0:14you. But again, that information is possible to spoof. Now it's not super easy

0:19to spoof that

0:20information, but it's definitely possible to spoof the information or what if

0:25somebody compromises

0:28one of the computers or paths in between where the email is coming from and

0:34where the email is

0:35going. Then it could be rewritten in route. And then even if SPF matches the

0:42message itself

0:44could have been messed with. So like it could have been an innocent email that

0:47was sent, but then

0:47it was rewritten to something nefarious or had malware attached or something

0:51like that. And that's

0:53where the next level of security for outgoing email comes in. And what we do is

0:59use D Kim,

1:00which stands for domain key identified mail. Again, these description or the

1:07the acronyms

1:08don't really give a lot even when you know what they stand for underneath. But

1:13D Kim basically

1:15uses encryption. So public private key encryption, it uses that to sign an

1:22outgoing email. And so

1:25what happens is there is a private key stored on the email servers and they use

1:30that private key

1:32to look at the entire email and then use that private key to attach a signature

1:39using their private

1:40key, which using the public key can be verified that the message itself has not

1:47been tampered with

1:48since that signature took place. And since the private key is only known by the

1:53servers,

1:54which are allowed to send email on your behalf, it has to be signed by, you

1:59know,

2:00one of those email servers. And they're the only ones with that private key. If

2:04you have the public

2:05key, which again is distributed via DNS, then the server that receives it can

2:13look at the

2:14signature and using that public key verify, yep, sure enough, this hasn't

2:17changed. This is exactly

2:19the email that was sent from the user. And so using that cryptographic

2:25signature, you can

2:27verify that it wasn't altered during transmission. It's the same message that

2:32was sent from the server

2:33is the one received by the receiving server. And so DKIM is an extremely

2:38powerful security layer

2:41on that is added to outgoing emails from your mail server. And we set that up,

2:47again, using

2:48DNS records, but we do have to generate the private and public key. Now, just

2:54for a quick visual,

2:55you know, here is the the private key. This is only stored on the server, only

3:00the server,

3:01the mail server that you use to send outgoing mail has that. And then when you

3:06have an email,

3:07it sort of puts its, you know, stamp on there. I guess this is my digital

3:12signature. And then

3:14any server that receives it can use the public key, which is available on,

3:20on DNS, to verify that yes, that is the proper signature that was created and

3:30signed

3:31with this private key. So I know that this email came from that server and wasn

3:37't altered along

3:38the way. I will quickly add that Google does not make it easy to rotate

3:44encryption keys. And what

3:45I mean by that is a lot of times people think that the best security practice

3:51is to rotate DKIM

3:52key pairs every six months or so. So after six months of using it, you create a

3:58new private

3:59and public key pair, you publish the new public key pair on your DNS server.

4:06And then you start

4:07signing with that new private key pair, you keep the old public key in DNS so

4:14that anybody who just

4:16hasn't opened your email yet, but was signed with the old private key can still

4:20verify it.

4:21But that best practice is difficult to do with Google because they only want to

4:28have one

4:29DKIM key active at once. And so in the interim time when you create a new key

4:35and then publish

4:35that, there might be some time where outgoing emails are not signed at all. And

4:41so most people

4:44just create the public private key pair and just leave it there. So if you're

4:49thinking, well, that's

4:50not the best security practice, you're right. Generally, we do recommend that

4:54DKIM keys are

4:57refreshed every six months. But Google doesn't necessarily recommend that and

5:03they don't offer

5:03a great way to make that happen without any interruption to service. So as long

5:08as the private

5:09key is not compromised, it should keep working, you know, indefinitely. And I

5:15just wanted to bring

5:16that up. So in case you're like, why didn't you tell us about rotating? Well,

5:18because Google

5:19doesn't really talk about rotate rotating the key pairs, even though industry

5:24standard says,

5:26generally you should rotate every six months. Now you can still do it. It's

5:30just in the interim,

5:31when like things are propagating and you're putting the new key into play,

5:36there might be some time

5:38where outgoing email isn't signed or the right keys aren't in place. So it can

5:43just be messy

5:43during that transitional time. But in order to get DKIM installed, we actually

5:47do have to do stuff

5:48here. And it's not just installing a DNS record, we have to create those keys,

5:53right? And Google

5:54has to know about them. So I'm back here in the admin panel, I'm going to go to

5:58apps this time.

5:58And inside Google workspace, if we scroll down to Gmail, so click on Gmail.

6:04And then down here, where it says authenticate email, everyone put myself over

6:11here, authenticate

6:12email is what they call setting up email authentication with DKIM, they say DK

6:16IM right there. So in here

6:19is where we set up that record. And right here, where it says generate new

6:23record, that's what we

6:24want to do, right? Because we want to generate the keys, and then it will give

6:29us the text record

6:30that we need to put in that text record will include the public key, which is,

6:34you know, publicly

6:36available. So selected domain nuggetlab.org. Yep, that's the one we want

6:41generate new record.

6:44The DKIM key bit length, the bigger, the better, like the 2048 key bit length

6:52is going to be more

6:53secure than a 1024. It's possible that the DNS provider won't support the

7:00longer one. So you'd

7:01have to use 1024. But I'm going to choose that a prefix selector is optional,

7:06but I'm going to

7:07leave in their their recommended one. And this is just so if you set up

7:11multiple DKIM records,

7:13like if you have multiple servers that are serving out DKIM authenticated

7:19emails,

7:20when you're looking at the DNS records, it's nice to be able to see which

7:25server, you know,

7:27which DKIM record is for. So the prefix selector is just for your own

7:31sake later on when you're trying to identify things. So I'm going to leave

7:35Google in there,

7:36you'll click generate. And now this is going to create the public and private

7:40key. We're not

7:41going to see the private key, though. Google keeps that to themselves, right?

7:45Google,

7:46the servers are the only ones who can see that private key. We don't want to

7:51see it. We only want

7:52the private key, or we only want the public key. Did I say private key? Google

7:58's the only one that

7:59is a private key. We want the public key to be publicly available. And so this

8:03is what we're

8:04going to put into our record. So first of all, the DNS host name, the text

8:08record, we copy this.

8:11And then go over to our DNS. Again, we're back here, we're going to say add a

8:16record. It's again

8:18going to be a text record. But now the name is actually, it's not just at this

8:24one is going to be

8:25Google dot underscore domain key. All right, so that's the domain or that's the

8:33host name that

8:34they gave us, we're going to leave them and say time to live is one minute. And

8:37then the content,

8:38this is where we put that public key, which is right here. So I'm going to

8:43highlight this entire thing.

8:45Copy that. I'm going to paste that in. All right, so it's all pasted in the

8:54entire record is right

8:55there. And now I'm going to click save. And now this is all we need to do to

9:00get the DKIM information

9:02on the internet on the public DNS, right, with our public key in that that

9:07record, that text

9:08record, which anybody on the internet can look up. But now it's it's active. It

9:13'll take a little

9:14while to propagate on the internet now though. And it says here, it may take up

9:17to 48 hours for

9:18the DNS changes to fully propagate. Now it doesn't normally with cloud flare,

9:23especially

9:24since I put that time to live so low. But we'll see, we won't be able to start

9:28authentication if

9:30that record is not active. But I'm going to try it. I'm going to click start

9:32authentication.

9:33Look at that. It allowed us to do that. So authentication is on using that

9:40record. So

9:41it's all set. We have DKIM configured. So outgoing email is going to not only

9:48pass SPF because we set

9:50that up, but now it's going to have a signature. Now the email itself is not

9:54going to be encrypted,

9:56but it's going to have a cryptographic signature applied to it so that it won't

10:02be able to be

10:03changed without that signature no longer matching the content. Hopefully that

10:08makes sense. We're

10:09not hiding the content of the email using DKIM. All we're doing is making sure

10:14the content of the

10:15email is not changed from what was initially sent, right? It's just it's

10:22verifying the integrity of

10:24of the email, it's not encrypting the email.

0:00Now the last layer of security or trustworthy addedness, that's not really a

0:06term, is going to be

0:08DMARC. Now DMARC stands for, I should have to look this one up. It's a domain-

0:14based message,

0:17authentication, reporting, and conformance DMARC. Mark with a C at the end.

0:23This is not

0:26something that is added to the email. This is another DNS record, this is a

0:31text record,

0:32and basically what the DMARC record does is it tells any receiving domain. So

0:38we send an outgoing

0:39email and the receiving email server gets an email from us, from one of our

0:45servers.

0:46If it doesn't pass SPF and/or DKIM, if one of those two or both of those fail,

0:54our DMARC record says, "Okay, if you get something from us that failed, here's

1:00what I would like

1:01you to do. Here is what we're designed or we are prepared for you to do in

1:06response to emails you

1:09receive that say they're from us, but are failing either SPF or DKIM." Now yes,

1:16SPF does include like

1:17that tilde all that says, you know, like, "Hey, you know, hold on to this or

1:22dash all, hey, you can

1:23get rid of this." But DMARC is a more robust methodology because it does a

1:28couple things. One,

1:30it allows the receiving email servers to have expectations about what you

1:36expect them to do

1:38if they get something that says it's from you but doesn't pass muster. It also

1:44provides another

1:45layer of trustworthiness, right? The receiving email server, if they see that

1:51you have a DMARC

1:53record configured, it means that you are expecting your SPF and DKIM efforts to

2:00be fruitful and to be

2:02working and you have instructions for, you know, receiving email servers to use

2:08if those fail. So

2:10you are actively trying to make email better. So it offers another layer of

2:15trustworthiness.

2:16But really the key with DMARC is that it allows those email servers a way to

2:23tell you if something

2:25goes wrong because everything else that we've had, all it does is give

2:30information to the receiving

2:32email servers. They get it and either SPF fails or passes, DKIM either fails or

2:38passes, and then

2:39they can decide what to do with it. Is it spam? Do I reject it? Do I market it?

2:43Spam and deliver it?

2:44With DMARC, it gives them an ability to report back to you so that you can see

2:51if something is

2:53misconfigured or if there's some third party sending all sorts of spam claiming

2:59to be you.

3:00And so that's really where DMARC shines is it gives other email servers the

3:06ability to report failures

3:09to an email address that you specify. And that is kind of like the frosting on

3:16the cupcake of

3:17email security because you're doing all of these things to make sure you're

3:22outgoing emails are

3:23secure and are validated and they've not been modified. DMARC gives those

3:30receiving servers the

3:32ability to basically tell you how you're doing. Or like I said, identify if

3:36somebody else, you know,

3:38is sending emails claiming to be you, but they obviously can't do a digital

3:42signature with DKIM.

3:44Usually where it's most beneficial though is if something is wrong with your SP

3:50F or your DKIM,

3:51you get told about it instead of just the remote servers dumping your stuff or

3:56marking it as spam.

3:58So DMARC helps everybody, but it definitely helps you to set up a DMARC record

4:04so that you can get

4:05reports on emails that are failing. Now a DMARC record looks fairly similar to

4:11an SPF record.

4:12I mean, there is a host that we use instead of just the @ symbol, but there are

4:17three fields that

4:19we're going to use now. I'm including a link in the skill just like I did with

4:25DKIM or with SPF,

4:26with SPF I think, that will show you the other options that you have. Like you

4:31can specify what

4:32to do with sub domain emails, but the basics are here. This is a required field

4:37. The first field is

4:39the version. So V equals DMARC one, just like we did with SPF one. Again, I don

4:45't know of any

4:45other version, but this is required to be the first field in the text record

4:51that we're creating.

4:53And then the next one is P. This is the procedure. What do you want them to do

4:59if they get something

5:01that doesn't pass SPF or DKIM? The options are none reject or quarantine. And

5:07this may sound

5:08counterintuitive, but most recommendations, especially when you're first

5:13starting, is to make this

5:15none, which means you're not expecting the receiving email server to reject or

5:23quarantine the email

5:25if it doesn't pass SPF or DKIM. You're just saying, no, no, I'm still setting

5:31things up or

5:32I'm not positive. I haven't configured properly. So for right now, I don't want

5:37you to do anything

5:39out of the ordinary with the actual email you receive. You know, if it, you

5:44know, if it gets

5:44marked as spam internally, so be it. But don't just get rid of it altogether.

5:48So generally,

5:49we'll do P equals none, especially for a while at first, until you're confident

5:55that your DKIM

5:57and your SPF is validated properly and emails are going out properly, then you

6:02could change

6:03your P to something like reject or quarantine. But leave any as none is fine

6:08too. The golden part

6:11here, the really important part, if you will, is this RUA field. So RUA equals

6:17and then

6:18mail to colon and email address. This is where we're asking the receiving email

6:24server to send

6:26information about emails they receive that do not pass SPF and DKIM. So if they

6:34get an email that

6:36says it's from us, but either DKIM or SPF or both fail, this is what we want

6:43them to do. We want them

6:45to tell us by sending a mail to whatever email address we specify. Now normally

6:51you wouldn't do

6:52this to an actual user account. It would be like an alias or, you know, some

6:57monitored account that

6:58you can go into. This is our only email address right now. So I'm saying, you

7:02know, send it all to

7:03admin@nuggetlab.org. But this is what a DKIM record looks like. We're going to

7:08add one into

7:09DNS again. There's nothing to configure inside the Google admin console. It's

7:14just a text record

7:16that we create. But we do have to make sure that it is formed properly. And you

7:21can look in that

7:21link that I put for more information about DMARC, but it's not too difficult to

7:25do. So let's get our

7:27our DNS server one more time and we're going to add one more text record. Okay,

7:33so back here again,

7:34I'm going to say add record. This is again going to be a text record TXT. Now

7:40the name here is important.

7:41We don't just put the ad we do underscore DMARC. So underscore DMARC.nuggetlab.

7:53org is going to be

7:54the record that we put in here. All right, so I'm going to say one minute. And

7:59then the content,

8:00this is where we put that content that we just talked about in that in that

8:05slide, right? So

8:06the first is going to be V equals DMARC one. And then a semicolon, a space P

8:16for what procedure

8:19or do we want them to do? I'm going to say equals none. Okay, don't want them

8:23to do anything.

8:25But and then semicolon space, R U A equals mail to colon admin at nuggetlab.org

8:37. Okay, so that is

8:38going to be our DMARC record. Going to click save. And now that's in place, we

8:44should see that right

8:45there in place. And now we should start getting reports if email servers are

8:52getting faulty or,

8:54you know, not validated with DKM or SPF records that say they're coming from us

9:00. All right, so

9:01ideally we don't want to get reports. But if we get, you know, if things go

9:05wrong, we should now get

9:06reports from mail servers. Now the only thing left to do is send an email from

9:12our account to an

9:14outside address and see what happens. So let's do that. Let's send an email to

9:19an outside address

9:22from our nuggetlab.org Google workspace and see what the email headers look

9:26like. All right, so

9:27here we are back at our Gmail inbox. This is the admin at nuggetlab.org. I'm

9:33going to compose an

9:34email. I'm going to send it to my personal email address. So Sean at brain of

9:39Sean.com.

9:39Yes, it's outside of my organization. See if I'm valid as a subject. I hope so.

9:50All right, so

9:51then I'm going to click send. So it's sent to my personal email address, which

9:57now I guess the whole

9:58world knows, but that's okay. What then we're going to do is go to my email and

10:03look at the headers

10:05of that. All right, and this is the email as it arrived in my inbox here. I'll

10:10try to make this a

10:11little bit bigger. This is a message ID, but it looks like to Sean at brain of

10:15Sean.com. Yes,

10:17that's a subject. And now we can see right here SPF it passed with an IP of 104

10:24blah blah blah.

10:25So what this mean, what that means is this IP address resolved to the include

10:32that we did in our

10:33SPF record, right? So the SPF record is obviously in place and working and it

10:40passed because

10:42that is the, you know, that IP address is part of the Google domain that they

10:47had us include. Okay,

10:49also the D Kim past, which means that our public key is publicly available on

10:55the internet. And

10:57it was properly signed by our outgoing email server with the private key that

11:03Google workspace

11:04has in a past and a D mark passed, which of course, I mean, it passed, meaning

11:08that they're not going

11:10to really do anything. We said for them not to do anything if it failed, but it

11:13didn't fail. So

11:14everything is set up. This is basically just their way of telling us that D

11:19mark is set up and

11:20properly configured. So everything is set up and working. We know our MX

11:25records work because we set

11:27that up in the first, you know, the first thing we did in this scale. So now we

11:31can be confident that

11:32when we send and receive emails using Google workspace, it's going to be the

11:38least likely

11:39that it will be flagged as spam because of how we have set up our server and

11:45with and those specific

11:46DNS records that pertain to email.

0:00Okay, there's not any really exact way to do this, but we'll say I'm gonna put

0:04myself over here

0:05So I can use myself in the in the image. Let's say that I want to send an email

0:11To my uncle Joe who is over here?

0:15Uncle Joe is wearing a mumu, but nonetheless uncle Joe is over there and I want

0:21to send him an email now uncle Joe has an email server

0:25Uncle Joe is a little bit older

0:28It's probably like an AOL.com server and I have my server over here, which is

0:35Gmail calm we'll say all right and so if I want to send an email to uncle Joe

0:44I type out my email all right, so I have my email and it's very

0:50Very poignant. It's it's a very good email. I then deliver this or I

0:57Submit it it might just be in a web browser, but I'm done

1:00I click send and it goes to the gmail.com email server now this email server

1:06has a particular IP address and

1:10That's just you know part of what it is

1:13Let's say its IP address is 1.2.3.4, which it is certainly not but let's say it

1:18is

1:18and the first thing it does is it the the email server takes my email and it

1:26adds a digital signature to it

1:29Which is the d Kim you know it uses the private d Kim key which is stored on

1:35the email server and

1:36It digitally signs it it kind of puts its stamp on this

1:41Email that says you know this is the the d Kim

1:45verification signature, okay, and then

1:49My server says okay. It's addressed to uncle Joe over at AOL.com

1:57So what my what the gmail.com server has to do is look up the DNS

2:02Entry the MX records for AOL.com. Okay, so gmail

2:08Looks up the records for AOL.com. Just the MX records. That's okay

2:12The MX record is like mail dot AOL.com or whatever and so then it takes my

2:18Digitally signed email and it sends it to

2:24uncle Joe's email server, which happens to be whatever was in the MX record and

2:29then this email server

2:31Says okay. I got an email address for my user uncle Joe

2:38So I'm gonna look I'm gonna say okay. Did it come from a

2:43Proper place it's you know

2:46Whatever it's gmail dot com right it came from gmail dot com

2:51So if I if this server looks up the DNS record

2:56The SPF record for gmail dot com. It says okay. Did it come from a server that

3:01's listed in the SPF record and if gmail dot com is the

3:05Address that it's using and it came from that address. So yes, so then it would

3:09say okay check SPF passes

3:12That's good and then it says okay

3:14I see that the email has a digital signature. So this goes over to DNS again

3:21And this time it grabs the DKIM public key and it uses this public key

3:29To verify whether or not this digital signature was actually signed

3:37By the server that has the private key and if so it says yep that signature

3:42checks out

3:43I use the private key that I found in the DNS record for gmail dot com

3:48And it passed now since both of those past it just delivers the email to uncle

3:55Joe and then uncle Joe gets it

3:56It doesn't go in a span folder because both SPF and DKIM both passed

4:01But if one of those failed then the server would say all right

4:06SPF didn't pass it came from an IP address not listed in SPF

4:11So now it looks back to the DNS records at gmail dot com for a d mark

4:18record

4:19And it says okay, I had a failure. What do I do and it looks up and you know in

4:23our case the D mark record might say

4:25None so then it might still pass it to uncle Joe

4:29But it might be listed as spam uncle Joe might have to check his spam folder

4:34because

4:35One of them like the SPF did not pass

4:38And along with you know, maybe marking it as spam but passing it along

4:43This server will also

4:46Send a report to whoever is listed in the d mark record and saying, you know,

4:52this is like a

4:52Whoa, something went wrong. I got this email or got these emails

4:58They said they were from you, but they didn't pass all the tests that I run on

5:02emails

5:03And so that's kind of the life cycle of an email when you include things like

5:09SPF DKIM and DMARC into the process

5:13It's totally fine if your explanation was a little bit different, but just make

5:16sure that you got all of the points

5:18That we talked about and you explained what they do how they function and what

5:23function they actually provide