fTLD implements DMARC for Public Suffix Domains

Last year, fTLD Registry Services (fTLD), announced a new security feature, Public Suffix Domains (PSD) DMARC for the .Bank and .Insurance Top-Level Domains (TLDs).

fTLD is a coalition of banks, insurance companies, and financial services trade associations from around the world. fTLD operates .Bank and .Insurance internet domain extensions as private, online gated communities to serve and protect financial services organizations from the most common cyberattacks.

PSD DMARC was developed by the Internet Engineering Task Force, which led to the release of RFC 9091. Following this, fTLD secured approval from the Internet Corporation for Assigned Names and Numbers to implement PSD DMARC.

The first non-governmental TLDs to utilize PSD DMARC protections, fTLD’s progressive requirement aims to help protect domains from phishing and improve email deliverability. Though fTLD has always required DMARC with .Bank and .Insurance domains, PSD DMARC adds a new layer of protection that started November 15, 2023.

---

---

In line with PSD DMARC, dmarcian added the functionality of processing PSD DMARC reports to help fTLD and domain owners gain visibility into and control of their email domains. In 2012 dmarcian released the world’s first DMARC XML-to-Human functionality to help people understand and adopt DMARC; this service is available to anyone for translating DMARC reports, including PSD.

DMARC Benefits

By deploying DMARC and, in time, advancing to an enforcement policy, fTLD registry organizations gain key benefits and protections, as DMARC is the primary control to observe and restrict email domains.

• Email fraud protection: With DMARC, organizations establish powerful email authentication protocols, reducing the likelihood of unauthorized access and protecting against email-based threats.

• Email reliability: DMARC is the foundation for reliable email delivery, and is often the first step taken to resolve email delivery issues.

• Regulatory Compliance: Industries, governments, and regulators are increasingly requiring DMARC. By adhering to these regulations, organizations demonstrate their commitment to data security.

• Reduced Financial Risks: Implementing DMARC can help mitigate financial risks associated with data breaches, including regulatory fines, legal liabilities, and reputational damage. By fortifying email security measures, organizations can minimize the potential financial impact of cyberattacks and data breaches.

• Industry-wide Collaboration: The fTLD DMARC requirement fosters information sharing among the registry’s organizations. By collectively strengthening email security measures, .Bank and .Insurance stakeholders can better combat email threats and vulnerabilities.

---

---

While deploying DMARC represents a significant step forward in cybersecurity, organizations must also prioritize ongoing monitoring and maintenance of their email security strategies to address evolving threats. Regular assessment of DMARC policies, analysis of email authentication reports, and proactive measures to address vulnerabilities are essential components of an effective email security framework.

Publishing email authentication records has always been a requirement for our .Bank and .Insurance domains. Having DMARC at p=reject ensures that only your organization, and those you authorize, can send email on your behalf, protecting against phishing and spoofing, and increasing the deliverability of email to your customers.

— fTLD

We’re Here to Help
With a team of email security experts and a mission of making email and the internet more trustworthy through domain security, dmarcian is here to help domain owners assess their domain catalog and implement and manage DMARC for the long haul.

---

Want to continue the conversation? Head over to the dmarcian Forum.