Spelldata List of Products and Services

Spoofing emails refer to the practice of sending emails that impersonate a company or individual, with the intent to infect with viruses or direct recipients to fake websites. Don't you often receive spoofing emails and think, "Isn't there something that can be done about this?" If an email impersonating your company reaches: - Business partners - Customers and causes damage, your company, which has not taken measures against spoofing emails, may be deemed to have "not taken necessary levels of countermeasures" and could bear liability for damages (Civil Code Article 709). In recent years, over 70% of security incidents have originated from emails. To protect email security, SPF, DKIM, and DMARC have been established as standard specifications. While setting up SPF, DKIM, and DMARC is easy for infrastructure engineers, the recent shift to cloud infrastructure has led to a loss of skills in DNS and email configuration. Using PowerDMARC makes it easy to set up SPF, DKIM, and DMARC. You can also audit email delivery status through clear "visualization"! For more details, please download the catalog!

This blog discusses the methods and countermeasures for phishing scams targeting insurance companies using Office 365. From April 15 to 30, 2020, PowerDMARC's security analysts discovered a new wave of phishing emails targeting major insurance companies in the Middle East. When our Security Operations Center tracked the links in these emails, it was found to be a phishing URL aimed at Microsoft Office 365 users. The solution is to adopt an authentication mechanism that checks all emails sent from your own domain and blocks only those sent without permission. As a leading provider of email security solutions, PowerDMARC is committed to raising awareness of the importance of protecting an organization's domain. *For more details, please refer to the related links. *For more information, please check the PDF materials or feel free to contact us.

On our company website, we introduce measures against spoofing emails and the specifications for email encryption. "SPF (Sender Policy Framework)" is a specification that explicitly notifies the receiving MTA of the authorized MTAs by listing the MTAs that can send emails using the managed domain's email addresses as DNS records. By setting up an SPF record, the receiving mail server can determine whether the email was sent from a legitimate mail server when it receives the email. For more information, please refer to the related links. [Contents] ■ Examples of operation ■ If only SPF is set, the handling of emails is left to the receiving mail server ■ If the sender wants to control the processing, DMARC settings are necessary ■ Is MX record not sufficient? ■ Limitations of SPF ■ Examples that cannot be prevented by SPF records alone *For detailed information, please refer to the related links. For further inquiries, feel free to contact us.

For Microsoft 365 users with DKIM enabled on their Office 365 domain, an error may occur stating that the DKIM record for selector2 cannot be found. This means that when DNS was referenced using selector2 as a resource locator, no results were obtained, and the receiving server failed to find the DKIM record for selector2. Why is DKIM selector2 not functioning on a Microsoft 365 domain? This blog discusses the causes and how to enable key rotation. [Contents] ■ DKIM record for selector2 not found ■ Results for DKIM selector1 ■ Results for DKIM selector2 ■ How to resolve "DKIM selector2 not working"? ■ Final step: Test DKIM selector2 *For more details, you can view the related links. *For more information, please refer to the PDF materials or feel free to contact us.

Do you think that cyber attacks only target large companies? In reality, cybercriminals often first infect small and medium-sized enterprises with viruses, and then embed those viruses in emails sent to large companies. The small and medium-sized enterprises that are used as stepping stones have all their intellectual property and client information stolen. Subsequently, similar products are mass-produced in places like China, leading to price competition that makes it impossible for them to generate profits. Furthermore, they may be held responsible for infecting large companies with viruses and could face liability for damages (as it falls under the tort of Article 709 of the Civil Code). The actual flow of an attack typically involves sending emails that impersonate employees of the target company or masquerade as clients to employees of that company. Once someone opens the email, they become infected, and the infection spreads from there. In other words, eliminating the initial "spoofed emails impersonating internal or external individuals" is key to protecting both your company and your clients. So, what should be done to eliminate spoofed emails? ★ We are currently offering explanatory materials. Please check them out via "PDF Download.

On our company website, we introduce measures against spoofing emails and the specifications for email encryption. "DKIM" (DomainKeys Identified Mail) utilizes public key cryptography, where the public key is recorded in DNS, and the MTA signs the email using a private key. This allows the receiving MTA to verify the authenticity of the sender and the integrity of the email content. By setting up the record, the receiving mail server can determine whether the email was sent by a legitimate sender upon receiving it. Please refer to the related links for more information. [Contents] ■ Example of operation ■ If only the DKIM settings are configured, the processing is left to the receiving mail server ■ If the sender wants to control the processing, DMARC settings are necessary ■ Is S/MIME not sufficient? *Detailed information can be viewed through the related links. For more details, please feel free to contact us.

On our company website, we introduce measures against spoofing emails and the specifications for email encryption. "DMARC" (Domain-based Message Authentication, Reporting & Conformance) is an extension of existing email authentication mechanisms, SPF and DKIM, and is a protocol specification that provides email domain owners with the ability to prevent spoofed email sending. We will provide detailed information about the three major roles of DMARC in the related links. Please take a look. [Contents] ■ The sending domain specifies the policy for how to handle emails that violate SPF or DKIM ■ Detecting spoofed From addresses (DMARC Alignment) ■ Receiving reports necessary for email auditing *For more details, please refer to the related links. Feel free to contact us for more information.

On our company website, we introduce measures against phishing emails and specifications for email encryption. "BIMI" (Brand Indicators for Message Identification) is a new email specification that allows the use of brand logos in email clients. By displaying the brand logo in customers' inboxes, organizations can leverage the efforts they have invested in implementing DMARC protection. To display the brand logo, the email must pass the DMARC authentication check, and it must be confirmed that the organization's domain is not spoofed. For more details, please refer to the related links. [Contents] ■ Basics of BIMI ■ Features of BIMI *Detailed information can be viewed through the related links. For more information, please feel free to contact us.

On our company website, we introduce measures against spoofing emails and the specifications for email encryption. "MTA-STS" (Mail Transfer Agent Strict Transport Security) is a mechanism that allows email service providers to declare their ability to receive secure SMTP connections via TLS and specify whether to reject delivery to MX hosts that do not provide TLS with a trusted server certificate from the sending SMTP server. In the related links, we provide a detailed introduction to the issues with STARTTLS and the features of MTA-STS. Please take a look. [Contents] ■ Issues with STARTTLS ■ Mechanism of MTA-STS *Detailed information can be viewed from the related links. For more information, please feel free to contact us.

We would like to introduce the features of the email security service 'PowerDMARC' under MENAInfoSec in the United States. The "hosting service" allows for centralized management from the portal's settings screen by referencing the values on the PowerDMARC side using CNAME, rather than directly rewriting the values of the DNS resource records. Please feel free to contact us if you have any inquiries. 【Features】 ■PowerSPF ■Hosted DKIM ■Hosted DMARC ■PowerBIMI ■PowerMTA-STS *For more details, please refer to the PDF document or feel free to contact us.

We would like to introduce the features of the email security service 'PowerDMARC' under MENAInfoSec in the United States. "What is the current configuration of our own domain's SPF/DKIM/DMARC/BIMI and MTA-STS?" and "What policies are applied when sending emails from each system?" can be understood through various analysis tools. Please feel free to contact us when needed. 【Features】 ■PowerAnalyzer ■MailAuth Analyzer ■PowerToolBox *For more details, please refer to the PDF materials or feel free to contact us.

We would like to introduce the features of the email security service 'PowerDMARC' under MENAInfoSec in the United States. "PowerAlert" is a feature that sends alert emails to a specified email address when it detects changes to DNS records or when it identifies a certain number of spoofed emails through forensic report analysis. Please feel free to contact us if you have any inquiries. 【Features】 ■ It is possible to set triggers for alerts - Changes to DNS resource records - Number of spoofed emails, etc. *For more details, please refer to the PDF document or feel free to contact us.

We would like to introduce the features of the email security service 'PowerDMARC' under MENAInfoSec in the United States. RUA/RUF reports are sent in XML format. It is difficult for humans to read XML, and writing an XML parser for analysis is also cumbersome. Our product parses the XML and stores it in a database, providing graphical visualization and powerful analytical capabilities. Please feel free to contact us if you have any inquiries. 【Features (partial)】 ■ DMARC compliance by sending source ■ By results ■ By organization ■ By host ■ By country * For more details, please refer to the PDF materials or feel free to contact us.

We would like to introduce the features of the email security service "PowerDMARC" under MENAInfoSec in the United States. Would you like to send data to external monitoring systems or data analysis platforms for integrated monitoring and analysis? With our product, it is possible to send data to external systems via API. Please feel free to contact us if you have any inquiries. *For more details, please refer to the PDF materials or feel free to contact us.

We would like to introduce the features of the email security service 'PowerDMARC' under MENAInfoSec in the United States. It can accommodate both individual domain settings and bulk registration of a large number of domains. User management can also be centralized, with permissions set in detail. Additionally, it comes equipped with various configuration features such as a setup wizard, user access templates, auditing, and forensic encryption. Please feel free to contact us if you have any inquiries. 【Features (partial)】 ■ Setup Wizard ■ Bulk Domain Registration ■ Domain Management ■ User Management ■ User Access Templates *For more details, please refer to the PDF document or feel free to contact us.

The invoice system will begin on October 1, 2023. Additionally, the revised Electronic Bookkeeping Act will become mandatory starting January 1, 2024. As a result, the entire industry has started to send invoices electronically. This raises the issue of "spoofing emails (phishing emails)." With the advent of generative AI like ChatGPT, it has become possible to create emails in natural-sounding Japanese, leading to an increase in cases where cybercriminals send sophisticated "fake invoices." If a fake email impersonating your company reaches your business partners or customers, the following problems may arise: - Personal information of employees or customers may be leaked, leading to lawsuits. - Important corporate secrets may be stolen and resold, causing your company to lose competitive advantage. - Company funds may be siphoned off. - Business partners may become infected with viruses through your company, resulting in huge compensation costs. (According to Article 709 of the Civil Code, your company may be deemed to have "not taken necessary measures" against spoofing emails and could bear liability for damages.) We have prepared a document that explains this situation in more detail and outlines potential solutions. Please download it and use it to ensure safe operations!

We will introduce the laws and systems related to phishing emails. Under the "Invoice System," it is stated that "when digitizing qualified invoices, it is necessary to implement phishing email countermeasures, similar to the Electronic Bookkeeping Act." The "Revised Electronic Bookkeeping Preservation Act" requires that "when sending invoices or receipts via email, they must be stored as electronic data." For more details, please be sure to read the published catalog. 【Related Laws and Systems】 ■ Invoice System (starting October 1, 2023) ■ Revised Electronic Bookkeeping Preservation Act (mandatory from January 1, 2024) ■ PCI DSS 4.0 compliance (by March 31, 2024) *For more information, please refer to the PDF materials or feel free to contact us.

Measures against spoofing emails are recommended. The Cabinet Office promotes the introduction of "Sender Domain Authentication Technologies (SPF, DKIM, and DMARC)" and the National Police Agency recommends "Current Status of Phishing and Measures to Prevent Damage, and Measures Against Spoofing Emails (DMARC) for Businesses." For more details, please read the catalog. 【Recommended Content (Partial)】 ■ Cabinet Office: Promotion of the introduction of Sender Domain Authentication Technologies (SPF, DKIM, and DMARC) ■ National Police Agency ・Current status of phishing and measures to prevent damage ・Recommendation of measures against spoofing emails (DMARC) for businesses ■ Ministry of Health, Labour and Welfare: Recommendation of DMARC by ISACs (Information Sharing Organizations) in various industries *For more details, please refer to the PDF document or feel free to contact us.

Spoofing emails refer to emails that impersonate companies or individuals. "Injecting viruses to steal sent and received data, spreading damage," and "stealing sent and received data from the infected email folder to impersonate a third party" are examples of increasingly sophisticated spoofing techniques. For more details, please be sure to read the catalog provided. 【Spoofing Techniques】 ■ Stealing sent and received data from the infected email folder to impersonate a third party ■ Taking the logo of the impersonated company from their website and pasting it into the email body ■ Stealing real email signatures to gain the target's trust *For more information, please refer to the PDF materials or feel free to contact us.

The targets of phishing emails are diverse. They include "reading credit card information for fraudulent use," "withdrawing large amounts of cash from bank accounts," and "stopping systems to demand money." Additionally, there are "terrorism aimed at disrupting factories and infrastructure." 【Targets (partial)】 ■ Reselling corporate secrets ■ Reselling customer personal information ■ Sending phishing emails impersonating business partners *For more details, please refer to the PDF document or feel free to contact us.

The liability for damages caused by impersonation emails may fall on the "impersonated party." If it is deemed that necessary measures have not been taken, such as not having antivirus software installed, the impersonated company may be held liable for damages based on tort law (Civil Code Article 709). Additionally, the directors of the company may be held liable for damages to the company due to violations of their duty to establish an internal control system. [Related Laws and Systems] ■ Invoice System ■ Revised Electronic Bookkeeping Act ■ PCI DSS 4.0 Compliance *For more details, please refer to the PDF document or feel free to contact us.