Re: SPAM filtering

["Frahm, Eric J Jr." <efrahm () ILLINOIS EDU>]

We have seen similar situations with poor SPF record or DKIM key management.  It appears the malintents do much better 
management of these that we do, sadly.  I have begun building filters based on DMARC, since that is a much more 
intentional record to maintain.  And I have created 'domain sets' for known domains who DO manage their records and 
have been the subject of fraud already (UPS, Fed-ex, many banks, etc), and enforce SPF or DKIM for mail from those 
domains only.  We are currently in the process of implementing DMARC and getting our own key domains to a DMARC policy 
of 'reject' or 'quarantine' in the coming year.


ERIC J FRAHM
LEAD APPLICATION SPECIALIST

Technology Services
University of Illinois at Urbana-Champaign
1535 DCL | M/C 256
1304 W. Springfield Ave.
Urbana, IL 61801
217.333.8794 | efrahm () illinois edu<mailto:efrahm () illinois edu>
www.techservices.illinois.edu<http://www.techservices.illinois.edu/>

[cid:image001.png@01D57920.8C8A5CD0]<http://illinois.edu/>

Under the Illinois Freedom of Information Act any written communication to or from university employees regarding 
university business is a public record and may be subject to public disclosure.



From: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU> On Behalf Of Thomas Carter
Sent: Wednesday, October 2, 2019 11:30 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] SPAM filtering

I wasn't sure which listserv to post this on, so I thought I'd give this one a shot.

We recently switched to Barracuda for our spam filtering solution. We started with the default settings, but have seen 
a large number of valid messages getting flagged due to incorrect DKIM and/or SPF settings, including other .edu 
domains. I've been trying to notify the ones we find, but I wildly underestimated the number of domains with incorrect 
SPF records; they have records, they just aren't correct (e.g. they use Office 365 for email, but don't have 
Microsoft's SPF info in their record). I think we're going to have to back off on filtering based on them. Do you flag 
emails based on SPF FAIL/soft FAIL or incorrect DKIM? Do you make sure it's correct at your institution?

Thomas Carter
Network & Operations Manager / IT
Austin College
900 North Grand Avenue
Sherman, TX 75090
Phone: 903-813-2564
www.austincollege.edu<http://www.austincollege.edu/>


**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community

**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community