A guide for IT managers and systems administrators
Pages
Page 10 of 14
Monitor, analyse and update your DNS records
Advice for when you have set up a DMARC policy of 'none', including monitoring your reports for at least two weeks and correcting any failures.
Implementing a DMARC policy of 'none' on your domains won’t affect the delivery of your email but neither will it prevent illegitimate emails being sent from your domains. For this, you must at least implement a DMARC policy of ‘quarantine’.
Before you do this, you must ensure that you have correctly configured DMARC andSPF andDKIM on your domains.
The roles of SPF, DKIM and DMARC
SPF provides host authenticity and DKIM provides a mechanism for checking message integrity.
These protocols do not tell organisations how to handle email, nor do they provide feedback to you, as the sending organisation.
This is the role of DMARC, which builds on top of SPF and DKIM.
When you have set up a DMARC policy of ‘none’
The receiving organisation will not change how it processes email sent from your domain – legitimate or illegitimate
Where the outgoing email from your domains originates (e.g. IP address)
The outcome of SPF and DKIM checks by the recipient – simply, whether it has passed or failed the SPF and DKIM checks.
Monitor your reports for at least 2 weeks
During this time, you might see a lot a ‘fail’ notices against the SPF and DKIM checks. You should also see a lot of legitimate sources passing checks. For example, you will recognise the IP addresses belonging to your organisation.
The reports will contain information about:
Legitimate email received directly
Legitimate email which has been forwarded by intermediary systems, such as mailing lists
Spoofed emails
You should use your anti-spoofing management tool to identify legitimate emails which are not passing either SPF or DKIM checks. You should then update your SPF or DKIM configurations so that they do.
Correcting failures
To correct SPF failures you should add the sending systems you use to your SPF record, either by IP address, or by reference to another SPF record. To correct DKIM failures, you should ensure a valid DKIM key is published in the correct place in DNS, and that outbound emails are being signed with it.
You may not recognise all of the sending systems listed in your reports. When this happens you should investigate to determine if a particular sending service is in use by your organisation.
It will likely take a few iterations of investigating, updating records, and waiting to review reports will be needed before you can gain enough confidence that you've got SPF and DKIM working for all of your sending systems.
Once you've reached this stage, you're ready to move to a DMARC policy of 'quarantine' which will provide anti-spoofing protections for your domain.
