[Security Engineering and Cryptography] Emails that the marketing department is sending to customers are pomp to the customers' spam folders. The security team is investigating the issue and discovers that the certificates used by the email server were reissued, but DNS records had not been updated. Which of the following should the security team update in order to fix this issue? (Select three.)

The problem describes emails being sent to spam, which is a common symptom of email authentication failure. Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) are the three primary DNS-based technologies used to authenticate email and prevent spoofing. SPF is a TXT record that lists authorized mail servers for a domain. DKIM uses a public key published in a DNS TXT record to verify a digital signature on the email. A reissued certificate often involves new cryptographic keys, requiring an update to the DKIM record. DMARC is a TXT record that defines the policy for handling emails that fail SPF or DKIM checks. Updating these three records ensures that the sender's identity is properly authenticated by receiving mail servers, which resolves the issue of legitimate emails being marked as spam.

D. DNSSEC: Secures DNS records from tampering but does not directly authenticate the email sender's identity to prevent spam classification.
E. SASC: Not a standard DNS record type or a recognized acronym related to email security or DNS.
F. SAN: A field within a digital certificate specifying additional hostnames, not a type of DNS record to be updated.
G. SOA: Contains administrative zone data; updating it is a procedural step but does not fix the underlying email authentication failure.
H. MX: Directs email traffic to the correct mail server but does not authenticate the messages, which is the root cause of the spam issue. ---

1. Internet Engineering Task Force (IETF) RFC 7489, "Domain-based Message Authentication, Reporting, and Conformance (DMARC)": Section 3, "How DMARC Works," explicitly states that DMARC is a mechanism that "uses the results of SPF and DKIM" to determine the authenticity of an email message and provides instructions to receiving mail servers on how to handle authentication failures. This establishes the interconnectedness of all three records.

2. Internet Engineering Task Force (IETF) RFC 6376, "DomainKeys Identified Mail (DKIM) Signatures": Section 3.6.2, "The TXT Resource Record," details how the public key used to verify the email's signature is stored in a DNS TXT record. A change in the server's keys, which can occur during a certificate reissue, would necessitate updating this DNS record.

3. Internet Engineering Task Force (IETF) RFC 7208, "Sender Policy Framework (SPF) for Authorizing Use of Domains in Email": Section 3.1, "Publication," specifies that the SPF policy for a domain is published as a TXT record in the DNS, which is used by receivers to verify the sending mail server's IP address.

4. MIT Information Systems and Technology (IS&T) Knowledge Base, "What are SPF, DKIM, and DMARC?": This university resource explains, "SPF, DKIM, and DMARC are three email authentication methods that help prevent spammers from sending messages on behalf of your domain... When properly configured, these records also help legitimate messages from being marked as spam." This directly links the three records to solving the problem described in the scenario.

5. Google Workspace Admin Help, "Ensure mail delivery & prevent spoofing (SPF, DKIM, DMARC)": This official vendor documentation states, "We strongly recommend you always set up these email authentication methods for Gmail: SPF, DKIM, DMARC... [They] help protect your domain against spoofing, and help prevent your outgoing messages from being marked as spam." This confirms that all three are required to fix deliverability issues.