Skip to main content

SP 800-177 Rev. 1Final2019

Trustworthy Email

At a glanceHow to stop attackers from spoofing your district's email domain and how to protect mail in transit, using SPF, DKIM, DMARC and TLS. Written for email administrators, and usable by small organizations. Read the domain authentication chapter first.

Reading level
Technical
Length
128 pages · about 45 min for the key parts
Best for
Technology directors, IT staff and service partners
CSF 2.0
Protect, Detect
Read it on NIST DOI 10.6028/NIST.SP.800-177r1 ↗

Browse the full library. 70 NIST publications summarized for school districts.

NIST library

Key concepts

The guide covers proving which domain sent a message (SPF, DKIM, DMARC), encrypting mail between servers (TLS with DANE or MTA-STS), signing and encrypting content (S/MIME), reducing bulk email and end-user email security.

How it is organized

  • Elements of email and threats to an email service
  • Authenticating a sending domain and messages: SPF, DKIM, DMARC
  • Protecting confidentiality: TLS (DANE, MTA-STS) and S/MIME
  • Reducing unsolicited bulk email
  • End-user email security

What a school district should take from it

  • A DMARC policy at 'reject' stops others from sending mail that claims to be from your district domain.
  • Domain authentication protects staff, families and vendors from messages that falsely use the district's own domain.

How to use it in your district

  1. Check your domain's SPF, DKIM and DMARC records with the Domain health tool.
  2. Move DMARC from 'none' to 'quarantine' to 'reject' after reviewing reports for a few weeks.
  3. List every service that sends mail as the district (notification systems, payroll) and authorize it in SPF or DKIM.
  4. Enable MTA-STS or equivalent so mail in transit stays encrypted.

Common misconceptions

Our email provider handles all of this.
Providers support it, but the district must publish and maintain the DNS records for its own domain.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

  • PR.PSPlatform Security
  • PR.DSData Security

Tools in the program portal

Related publications

Citation and source

SP 800-177 Rev. 1, Trustworthy Email. National Institute of Standards and Technology. 2019. https://doi.org/10.6028/NIST.SP.800-177r1.

Replaces: SP 800-177 (2016).

Topics: Email security. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.