From 195f919abef02619ac685e6f8d2155d8f8eddab3 Mon Sep 17 00:00:00 2001 From: gearnode Date: Tue, 7 Jan 2025 18:06:47 +0100 Subject: [PATCH] Add DKIM control Signed-off-by: Bryan Frimin --- .../COM-EMAIL-001_dkim_implementation.md | 39 +++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 controls/communication-security/email-security/COM-EMAIL-001_dkim_implementation.md diff --git a/controls/communication-security/email-security/COM-EMAIL-001_dkim_implementation.md b/controls/communication-security/email-security/COM-EMAIL-001_dkim_implementation.md new file mode 100644 index 000000000..e02f97f5b --- /dev/null +++ b/controls/communication-security/email-security/COM-EMAIL-001_dkim_implementation.md @@ -0,0 +1,39 @@ +--- +id: "COM-EMAIL-001" +category: communication-security/email-security +revision-version: 1 +revision-date: 2024-01-07 +estimate-time: "30m" +frameworks: + - name: "soc2" + sections: ["CC6.1", "CC6.8"] +--- + +## Purpose +DKIM (DomainKeys Identified Mail) helps prevent email spoofing by +adding a digital signature to outgoing messages, allowing receiving +mail systems to verify that emails genuinely came from your domain and +weren't modified in transit. + +## Risk Assessment + +| Risk | Impact | Reason | +|---------------------------------|--------|----------------------------------------------------------------------| +| Phishing and Social Engineering | 8 | Reduces phishing by preventing email spoofing of company domains | +| Business Email Compromise (BEC) | 8 | Prevents attackers from impersonating trusted partners or executives | + +## Implementation + +### Google Workspace + +1. Go to [Google Admin console](admin.google.com). +2. Navigate to Apps > Google Workspace > Gmail > Authenticate Email. +3. Select your domain and click "Generate new record". +4. Copy the DKIM TXT record provided by Google. +5. Add this TXT record to your DNS. +6. After DNS propagation, return to Admin console and click "Start authentication". + +## Evidence + +- Screenshot of published DKIM DNS record +- Sample email headers showing DKIM pass