In the first part of this article, we discussed key technologies such as Mail Gateway, antispam filters, DKIM and SPF, essential for protecting business email. Now, in this second part, we will explore additional protocols such as DANE, MTA-STS and BIMI, which complement and reinforce security in email communication. We will also discuss other advanced measures that you can implement for more robust protection.

Securing TLS Connections

The protocol DANE (DNS-based Authentication of Named Entities) adds a layer of security to email by ensuring that connections between email servers are made using TLS (Transport Layer Security). DANE uses the system DNSSEC (DNS Security Extensions) to verify the authenticity of TLS certificates, preventing server spoofing attacks.

DANE has advantages such as:

• Protects against attacks Man-in-the-Middle (MitM).
• Strengthens the authentication of security certificates.

It also has drawbacks such as:

• DNSSEC and DANE require advanced DNS configuration.
• Not all email providers support DANE, which limits its adoption.

Another fundamental protocol for securing connections between servers is MTA-STS (Mail Transfer Agent Strict Transport Security). This protocol forces the use of TLS in communications SMTP, which prevents emails from being sent without encryption.

The benefits are:

• Prevents downgrade attacks, where an attacker attempts to force an unencrypted connection.
• Ensures that emails between servers are always sent securely.

Please note:

• MTA-STS It is easy to implement, but requires the DNS is correctly configured and the server supports TLS.
• Unlike DANE, does not depend on DNSSEC, which simplifies its configuration.

He TLSA record in combination with DANE helps administrators validate which certificates are trusted to establish secure connections over TLS. This ensures that communications cannot be easily intercepted through the use of fake certificates.

The advantages:

• Ensures verification of the certificate used by mail servers.
• Adds an extra layer of authentication to connections TLS.

BIMI: Authenticity and Branding in Email

BIMI (Brand Indicators for Message Identification) not only improves security, but also adds business value by allowing authentic emails to display the brand logo in the email client. This protocol reinforces visual authenticity and helps prevent phishing.

Important:

• Reinforces trust in emails by displaying a verified logo.
• Improve the branding and brand visibility.
• BIMI depends on the correct implementation of DMARC, so an incorrect configuration of SPF either DKIM will affect its functionality.

Greylisting: Temporary Spam Filter

Greylisting is a technique that temporarily delays the delivery of emails from unknown senders. By asking the sender to try to resend the email, this technique manages to block much of the spam automated, as legitimate systems attempt to resend the message, while spammers often fail.

Two Factor Authentication (2FA)

Although it is usually used to access accounts, implementing 2FA for email sessions can protect accounts from unauthorized access, even if credentials have been compromised.

It is essential to remember that both DANE, MTA-STS, BIMI and other advanced measures complement the protocols mentioned in the first part of this article, such as SPF, DKIM and Mail GatewayThe combination of these methods forms a comprehensive solution to maintain the balance between security and usability.

Email security is a constantly evolving challenge. While protocols such as SPF, DKIM and antispam filters New technologies such as are essential DANE, MTA-STS and BIMI add additional layers of protection and visibility. It is important for IT administrators to maintain continuous vigilance and adapt configurations as attackers’ tactics evolve. Only a comprehensive approach that includes both classic and innovative measures can ensure robust security for business email.

Maintain a balance between security, authenticity and ease of use It is key to optimizing the user experience and ensuring the integrity of digital communication.

For more information, keep reading our blog and our upcoming posts!