Countermeasures Against Spoofing Emails in Questetra BPM Suite

2024-01-23: Published
2024-07-16: Modifications for supporting DKIM settings in any domain (adding links, etc.)
2026-07-02: Added explanation regarding DMARC

Many people have been harmed by email spoofing in recent years. Therefore, email senders must have measures in place to prevent this*. The following sender domain authentication is a countermeasure against spoofing emails that can be implemented by email senders.

SPF “Sender Policy Framework”
- Verifies the sender domain based on the IP address of the sending mail server
DKIM “DomainKeys Identified Mail”
- Digitally sign and validate outgoing emails
DMARC “Domain-based Message Authentication, Reporting, and Conformance”
- Defines how receiving servers should handle emails that fail SPF / DKIM authentication

*For example, Gmail has these guidelines
Gmail Help “Email sender guidelines”

According to the guidelines, all senders must support either SPF or DKIM. In addition, senders who send more than 5,000 messages per day must support both SPF and DKIM after February 1, 2024.

Since it is not possible to send a large number of emails from Questetra BPM Suite, it is not expected to fall into this category of “senders who send more than 5,000 emails per day” in normal use.

Sender Domain Authentication in Questetra BPM Suite

In Questetra, emails can be sent using automated steps in the workflow. If the user does not specify a From address, it is set to “no-reply@s.questetra.net” by default.

DKIM signatures are implemented with the questetra.net domain*, so emails are sent with a first-party signature. On the other hand, if the From address is changed, the DKIM signature with the questetra.net domain is still added, but it is treated as a third-party signature.

*In fact, the DKIM signature will be on the “s.questetra.net” domain. Also, in the trial version of workflow platform, the From address is “no-reply@f.questetra.net” and the DKIM signature is in the f.questetra.net domain.

The SPF setting is our recommendation for users who specify an email address as their From address when sending emails.

DKIM Signing with Custom Domains

DKIM signing (sender signing) is also available using a custom domain specified by the user.

Specifically, Questetra users (system administrators) can register the private key of the sender’s domain in their workflow platform (Advanced Edition and above). This allows DKIM signing (first-party signature) to be performed using the registered private key when an email is sent with a From address that uses the specified domain. In addition, by properly configuring and operating SPF / DKIM, DMARC compliance is also possible.

Controlling Email Authentication Policies with DMARC

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a mechanism that instructs receiving mail servers on how to handle emails (allow, quarantine, or reject) based on SPF and DKIM authentication results.

While SPF and DKIM alone cannot control the behavior when authentication fails, configuring DMARC allows you to explicitly define policies and prevent spoofed emails.

Integrated evaluation of SPF/DKIM results
Policy specification for authentication failures (none / quarantine / reject)
Visualization of sending status via reports

How to Configure DMARC

DMARC is configured by adding a TXT record to DNS. The target for configuration is the “_dmarc” subdomain of the sending domain.

Basic Configuration Example

v=DMARC1; p=none; rua=mailto:dmarc-report@example.com

v

DMARC version (fixed as DMARC1)

p

Policy (none / quarantine / reject)

none: Monitoring only (no impact)
quarantine: Treated as spam
reject: Rejected

rua

Email address to send aggregate reports to

Setup Procedure

Verify that SPF and DKIM are configured correctly
Add a TXT record for the “_dmarc” subdomain to DNS
Start operations with p=none
- Setting it to reject immediately may cause legitimate emails to be blocked
Gradually strengthen the policy while monitoring the reports

For DMARC to be valid, either the SPF or DKIM must match (or be within the allowed tolerance) the domain of the “From” address. If using a third-party sending service, please ensure consistency with the “From” domain.

Questetra remains committed to continuously developing and improving its features so that Questetra users can use their workflow platform in a safe, secure, and convenient manner.