Twitter stops phishing with DMARC

Twitter is adopting Domain-Based Message Authentication, Reporting and Conformance (DMARC), a new specification designed to authenticate emails so users don't fall for phishing attacks.

The technology  helps prevent users from receiving phishing emails puporting to come from Twitter, among the most abused brands on the web.

DMARC is not a standalone protocol, but one that works in concert with popular security methods already adopted: DomainKeys Identified Mail (DKIM), a technique that associates a domain name to an email message, and Sender Policy Framework (SPF), which detects spoofing.

It is used by brands including PayPal as an alternative for blacklisting. 

"Without getting too technical, DMARC solves a couple of long-standing operational, deployment, and reporting issues related to email authentication protocols," Twitter's postmaster Josh Aberant said.

"It builds on established authentication protocols (DKIM and SPF) to give email providers a way to block email from forged domains popping up in inboxes. And that in turn lessens the risk users face of mistakenly giving away personal information."

This article originally appeared at scmagazineus.com