An organization keeps receiving spam that appears to come from its own domain No accounts have been compromised. Which of the following will BEST mitigate this issue?

The issue described is email spoofing, where an attacker forges the "From" address to make an email appear as if it originates from the organization's own domain. Sender Policy Framework (SPF) is an email authentication standard designed specifically to prevent this. An organization publishes an SPF record in its DNS, which lists all the IP addresses of the servers authorized to send email on its behalf. When a receiving mail server gets an email, it checks the SPF record of the purported sending domain to verify that the email came from an authorized server. This directly mitigates the spoofing described in the scenario.

A. DNS: This is too general. While SPF is implemented using a DNS record, DNS itself is the entire domain name system, not the specific security mechanism.
B. S/MIME: This provides message-level security through encryption and digital signatures, but it does not prevent domain-level spoofing at the mail server gateway.
D. SSID: A Service Set Identifier is the name of a wireless network (Wi-Fi). It is entirely unrelated to email protocols or security.

1. Kitterman

S. (2014). Sender Policy Framework (SPF) for Authorizing Use of Domains in Email

Version 1. RFC 7208. Internet Engineering Task Force (IETF).

Section 1 (Introduction): "Email on the Internet can be forged in a number of ways. In particular

the address in the 'From' header field of an email message can be forged... This document describes the Sender Policy Framework (SPF)

a mechanism by which a domain owner can publish a policy regarding the use of its domain names in email." This document is the definitive standard for SPF.

2. University of Washington

UW-IT Connect. (n.d.). Email Authentication (SPF

DKIM

DMARC).

SPF Section

Paragraph 1: "Sender Policy Framework (SPF) is a DNS-based email authentication method that specifies which mail servers are authorized to send email for your domain. The purpose of SPF is to detect and prevent spammers from sending messages with forged 'From' addresses at your domain."

3. Indiana University

University Information Technology Services. (2023

October 25). About SPF

DKIM

and DMARC records. Indiana University Knowledge Base.

SPF Section

Paragraph 1: "An SPF record is a TXT record that is part of a domain's DNS zone file. The SPF record lists the mail servers that are authorized to send email for the domain." This resource from a major university's IT department confirms the function and implementation of SPF.