E-mail domain security policies

Soon, we will enforce some additional e-mail security protocols, SPF, DKIM and DMARC.

Enforced SPF, DKIM, and DMARC mean that receiving mail servers will block or quarantine any emails sent from our domain that do not pass strict cryptographic and policy checks. This will prevent abuse by 3rd parties trying to impersonate users at our domain. It should also increase our trust score at various external domains, so there will be less chance that properly sent mail from us is seen as spam.

As a matter of fact, we had been preparing these setups for quite some time now, but now we are forced to put them in place quickly, since it seems some of the big mail providers in the world are already assigning “possible spam” status to mails coming from domains that don't have these policies.

• No change to daily composition: Writing and sending emails from your regular email client looks and feels the same; all the mandatory security and integrity checks happen in the background at the mail server.
• Legitimate mail requires verification: Every service sending email on behalf of our domain (such as marketing platforms, external mass-mailing tools, etc) must be explicitly authorized.
  • So, if you are making use of external mass-mailers (eg mailchimp), using an institute mail address as the sender, we need to know and we need to prepare for it (and not every setup may work)
  • Our internal mail tools such as mailman will of course continue to work, as will mail send from websites hosted in our domain.
• Better protection against impersonation: Attackers can no longer easily fake emails using our department's name or domain address, protecting both internal staff and external recipients.
• At the same time, we will add similar checks on incoming mail. This will probably catch a lot of spam, but it may also intercept mails from misconfigured sender domains.

• Sending mail through another mail server than that of our institute will trigger the security checks. After all, a mail claiming to come from someone@strw.leidenuniv.nl but sent from a ziggo mailserver is no different than a scam mail claiming to be from professordirector@strw.leidenuniv.nl sent from some spammer-controlled server.
  • So, one might want to check mail client setups to ensure outgoing mail uses the right mail server. Most people will already have a correct setup on laptops in order to be able to send mail from anywhere in the world, but do heck home desktop computers that may have some default sertup from your internet provider.
• With authentication, our mailservers are reachable from everywhere in the world (except places that have restrictive internet policies, but that is beyond our control)
  • If you find yourself in a place that doesn't allow connections to our mail server, vpn might help, and webmail is also an alternative.
• Remember , gmail and other cloud provides are also external mail environments. So if you want to use gmail to handle your institute mail (which, btw, is against university policies), make sure you configure it to deliver mail using our mail server. It can be done, and if you encounter this problem, we can try to help.