False Positive Detection in Sender Domain Authentication by DMARC Report Analysis

The number of spoofed emails is increasing rapidly and become a serious problem, especially in business and e-commerce. Sender domain authentication is an effective countermeasure for spoofed e-mail. Although SPF, DKIM, and DMARC are famous sender domain authentication methods, these methods erroneously determine legitimate e-mails as malicious e-mails, such as forwarded messages. On the other hand, DMARC has a reporting function, which e-mail senders can receive DMARC reports that include SPF and DKIM authentication results, and the sender's domains, and so on. Generally, spam e-mails countermeasures are combined with three approaches: TCP/SMTP session monitoring, sender domain authentication, and contents filtering. Since sender domain authentication is usually processed before contents filtering, the occurrence of many false positives in sender domain authentication is a serious problem. In this paper, we propose a method to detect legitimate IP addresses by adapting X-means clustering to DMARC reports data in order to detect false positive deliveries in sender domain authentications. We apply actual DMARC reports data received from 28th September to 5th October 2019 to our approach. As a result, our method classified 254 to 480 IP addresses per day as legitimate addresses. As an evaluation, we confirmed that 2.8% to 11.1% of e-mails from legitimate IP addresses detected by our method were failed the combination of SPF or DKIM verification, and 36.9% to 62.7% of them were failed to DMARC authentication. From these results, we confirmed the proposed method can detect false positive deliveries caused by conventional sender domain authentication with high accuracy.