NIST SPECIAL PUBLICATION 1800-6B Domain Name System-Based Electronic Mail Security Volume B: Approach, Architecture, and Security Characteristics Scott Rose Information Technology Laboratory National Institute of Standards and Technology William Barker Dakota Consulting Silver Spring, MD Santos Jha Chinedum Irrechukwu The MITRE Corporation McLean, VA Karen Waltermire National Cybersecurity Center of Excellence National Institute of Standards and Technology January 2018 This publication and its additional content is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-6 DISCLAIMER Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST or NCCoE, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. This publication is availabl National Institute of Standards and Technology Special Publication 1800-6B, Natl. Inst. Stand. Technol. Spec. Publ. 1800-6B, 72 pages, (January 2018), CODEN: NSPUE2 e free e of charge from: https:// All comments are subject to release under the Freedom of Information Act (FOIA). doi.org/10.6028/NIST.SP.1800 - 6 . National Cybersecurity Center of Excellence National Institute of Standards and Technology 100 Bureau Drive Mailstop 2002 Gaithersburg, MD 20899 Email: [email protected] NIST SP 1800-6B: Domain Name System-Based Electronic Mail Security i NATIONAL CYBERSECURITY CENTER OF EXCELLENCE The National Cybersecurity Center of Excellence (NCCoE), a part of the National Institute of Standards and Technology (NIST), is a collaborative hub where industry organizations, government agencies, and academic institutions work together to address businesses’ most pressing cybersecurity issues. This public-private partnership enables the creation of practical cybersecurity solutions for specific This publication is availabl industries, as well as for broad, cross-sector technology challenges. Through consortia under Cooperative Research and Development Agreements (CRADAs), including technology partners—from Fortune 50 market leaders to smaller companies specializing in IT security—the NCCoE applies standards and best practices to develop modular, easily adaptable example cybersecurity solutions using commercially available technology. The NCCoE documents these example solutions in the NIST Special Publication 1800 series, which maps capabilities to the NIST Cyber Security Framework and details the steps needed for another entity to recreate the example solution. The NCCoE was established in 2012 by NIST in partnership with the State of Maryland and Montgomery County, Md. e free e of charge from: https:// To learn more about the NCCoE, visit https://nccoe.nist.gov. To learn more about NIST, visit https://www.nist.gov. NIST CYBERSECURITY PRACTICE GUIDES NIST Cybersecurity Practice Guides (Special Publication Series 1800) target specific cybersecurity challenges in the public and private sectors. They are practical, user-friendly guides that facilitate the adoption of standards-based approaches to cybersecurity. They show members of the information security community how to implement example solutions that help them align more easily with relevant standards and best practices and provide users with the materials lists, configuration files, and other doi.org/10.6028/NIST.SP.1800 information they need to implement a similar approach. The documents in this series describe example implementations of cybersecurity practices that businesses and other organizations may voluntarily adopt. These documents do not describe regulations or mandatory practices, nor do they carry statutory authority. ABSTRACT This document proposes a reference guide on how to architect, install, and configure a security platform for trustworthy email exchanges across organizational boundaries. The project includes reliable authentication of mail servers, digitally signing and encrypting email, and binding cryptographic key - 6 . certificates to sources and servers. The example solutions and architectures presented here are based upon standards-based and commercially available products. The example solutions presented here can be used by any organization implementing Domain Name System-based electronic mail security. KEYWORDS authentication; data integrity; digital signature; domain name system; electronic mail; encryption; internet addresses; internet protocols; named entities; privacy NIST SP 1800-6B: Domain Name System-Based Electronic Mail Security ii ACKNOWLEDGMENTS We are grateful to the following individuals for their generous contributions of expertise and time. This publication is availabl Name Organization Bud Bruegger Fraunhofer IAO Victoria Risk Internet Systems Consortium Eddy Winstead Internet Systems Consortium e free e of charge from: https:// Paul Fox Microsoft Corporation Janet Jones Microsoft Corporation Nate Lesser National Cybersecurity Center of Excellence Karen Waltermire National Cybersecurity Center of Excellence Doug Montgomery NIST ITL Advanced Networks Technologies Division doi.org/10.6028/NIST.SP.1800 Ralph Dolmans NLnet Labs Benno Overeinder NLnet Labs Joe Gersch Secure64 Saksham Manchanda Secure64 - 6 . NIST SP 1800-6B: Domain Name System-Based Electronic Mail Security iii The Technology Partners/Collaborators who participated in this build submitted their capabilities in response to a notice in the Federal Register. Respondents with relevant capabilities or product components were invited to sign a Cooperative Research and Development Agreement (CRADA) with NIST, allowing them to participate in a consortium to build this example solution. We worked with: This publication is available free of charge from: Technology Partner/Collaborator Build Involvement Fraunhofer IAO Configuration of DNS Services products and Mail Transfer Agent Internet Systems Consortium DNS Services software Microsoft Corporation Mail User Agent, Mail Transfer Agent, and DNS Services products NLNet Laboratories DNS Services products and configuration of Mail Transfer Agent Secure64 DNS Services and Mail User Agent products and configuration of Mail User Agent and Mail Transfer Agent https:// doi.org/10.6028/NIST.SP.1800 - 6 . NIST SP 1800-6B: Domain Name System-Based Electronic Mail Security iv Contents 1 Summary ............................................................................................ 1 1.1 Challenge ....................................................................................................................... 2 This publication is available free of charge from: 1.2 Solution ......................................................................................................................... 3 1.3 Benefits .......................................................................................................................... 4 2 How to Use This Guide ........................................................................ 5 2.1 Typographical Conventions ........................................................................................... 6 3 Approach ............................................................................................ 7 3.1 Audience ........................................................................................................................ 9 3.2 Scope ............................................................................................................................. 9 3.3 Assumptions ................................................................................................................ 10 3.4 Risk Assessment .......................................................................................................... 11 3.5 Technologies ................................................................................................................ 32 4 Architecture ...................................................................................... 35 https:// 4.1 Usage Scenarios Supported ......................................................................................... 35 doi.org/10.6028/NIST.SP.1800 4.2 Architectural Overview ............................................................................................... 37 5 Outcome .......................................................................................... 45 5.1 The User’s Experience ................................................................................................. 46 5.2 The System Administrator’s Experience ..................................................................... 50 6 Security Characteristic Analysis ......................................................... 51 6.1 Assumptions and Limitations ...................................................................................... 51 6.2 Build Testing ................................................................................................................ 51 - 6 . 6.3 Scenarios and Findings ................................................................................................ 57 7 Future Build Considerations .............................................................. 59 Appendix A List of Acronyms ................................................................. 60 Appendix B References ......................................................................... 63 NIST SP 1800-6B: Domain Name System-Based Electronic Mail