Organizations use SPF, DKIM, and DMARC to ensure attackers cannot launch phishing attacks impersonating senders from their domain.

Emails from the organization’s domains are not sent only from the organization itself (for example, their Microsoft 365 tenant), but also from many other sending sources like Salesforce, Marketo and others.

To ensure the business is not harmed by partners/customers blocking legitimate emails from the organization’s domains, you should make sure your SPF and DKIM records are properly maintained and include all legitimate sending sources.

The organization’s DMARC DNS record – specifically the p tag - states what should be done with emails that fail authentication checks.

Three possible values to the p tag in the DMARC record:

• none – recipients should report failures but should also deliver emails allegedly from the domain even if they fail authentication.

• quarantine – recipients should quarantine emails that fail authentication. They would usually be marked as spam.

• reject – recipients should not even accept the email and never deliver it to their end users.

Since this is usually a difficult task, most organizations do not have a DMARC policy (p) tag at all or assign the value none to it.

DMARC Management helps organizations make sure all legitimate senders are allowed so that you can confidently apply a restrictive policy tag in your organization's DMARC DNS record.

Benefits

DMARC Management helps you safely transition to a restrictive DMARC policy. It includes:

• Visibility to all the services sending emails on behalf of your domains and subdomains

• Search all DMARC failed emails sent on the organization's behalf

• Actionable DMARC record change recommendations.

Prerequisites

Periodically, email receivers send aggregated reports containing information on all emails they received from your domain, the IP address from which they received the emails, and the authentication results (SPF and DKIM) for each IP address. These reports are sent to the email addresses (RUA mailbox) defined in your domain's DNS DMARC record with the rua tag.

Sample DMARC record content:

Avanan needs to get the aggregated DMARC RUA reports. To do that, you must configure the rua tag of your DMARC record:

RUA Mailbox Hosted by Avanan

Organizations that send large amounts of emails to external recipients often get a lot of DMARC RUA reports in a short period of time. The amount is so large, that Microsoft and Google often reject some of them, to meet their maximum allowed incoming emails rate.

Avanan automatically creates a dedicated RUA mailbox for every tenant (account) in the Avanan Portal.

To use the dedicated RUA mailbox:

1. Access the Avanan Portal and click DMARC > Overview.
2. From the top of the page, click Configuration.
   
   The DMARC Configuration pop-up appears.
3. From the Your Hosted reports mailbox field, copy the dedicated RUA mailbox created for your tenant (account).
   
4. Click OK.
5. Add the RUA mailbox to the list of email addresses for the rua tag in your DMARC DNS record.

Note - DNS changes might take up to 24 hours to reflect in the Avanan portal.

External Reporting Authorization Record

To make sure that the DMARC records for your domain are accepted by Avanan after you add the Avanan hosted mailbox to your DMARC record, Avanan automatically adds an External Reporting Authorization Record.

It creates a domain name in the format: <your_domain>.com._report._dmarc.dmarc-cp.com. In this domain, a TXT record is added with this content: "v=DMARC1":

Note - This process could take a couple of hours after Avanan detects the update to your DMARC record.

Reviewing the DMARC Status of your Domains

The Overview page shows a list of all the organization's protected domains and subdomains.

To view the Overview page, click DMARC > Overview.

Tracking Improvements in SPF and DKIM Hygiene

From the Overview page, you can view a graph that shows the trend of the DMARC failure rate per subdomain over time.

The graph allows you to track improvements in the SPF and DKIM hygiene for these domains, resulting in a lower DMARC failure rate.

To filter specific domains in the graph, click on the legend of the other domains to turn them off.

Changing View to Top Level Domains

By default, the Overview page shows the status of different subdomains. To change the DMARC status view to aggregate the results based on top level domains, click Group Domains.

While viewing the aggregated results based on top level domains, to clear the aggregated results and view the status of different subdomains, click Ungroup Domains.

Annotating / Tagging Domains and Sending Sources

While analyzing the subdomains, administrators need to annotate domains to differentiate between them.

To add a custom tag to a domain or subdomain:

1. Click the vertical ellipses icon in the last column of the domain.
2. Click Update Tags.
3. In the Tags field, enter one or more tags separated by a comma.
   
4. Click OK.

Note - Annotating / tagging domains does not impact the DMARC status of the domain and does not change the domain’s DNS.

Investigating the DMARC Status of Domains

The Overview page allows you to drill down to domains and analyze the sources sending emails on the organization's behalf.

To analyze the DMARC status of a domain, click the domain from the table. The system shows these details describing the different sending sources:

Investigating a Specific Sending Source

You can drill down to a specific sending source for a particular domain to investigate the IP addresses from which the sending source sent emails on behalf of the domain.

To do that, after you drilled down to the specific domain, click on one of the source names in the Sent via Source column. The system shows these details:

Investigating a Single Sending IP Address

To view more information about the IP address of a specific sending source, click the IP address from the table. The system shows these details for the IP address:

Viewing Specific RUA Reports

To view a specific RUA report:

1. Click DMARC > RUA Explorer.
   The system shows a table with all the RUA reports received.
   

2. Click on the link in the Report ID column to view its raw XML content.

Improving your Domains’ DMARC Enforcement

The Recommendations page shows a list of actionable recommendations to safely configure a restrictive DMARC policy for your domains and helps to maintain SPF and DKIM hygiene.

To view the Recommendations page, click DMARC > Recommendations.

To export the data in CSV format, click Export to CSV.

Possible recommendations:

• Adding IP addresses to SPF

• Properly configuring RUA mailboxes for your domains

• Implementing a DMARC policy where p=none

• Implementing a restrictive policy for certain domains

  • This is done when the percentage of DMARC failures is below 3%

• and so on.

Monitoring SPF and DMARC Changes

The DNS Change-Log page shows changes to the SPF records and the DMARC policies of your domains.

To view the DNS Change-Log page, click DMARC > DNS Change-Log.

Annotating / Commenting on SPF and DMARC Changes

You and your team can add custom comments to every change. This is helpful in investigating or auditing a specific event.

To add comments to a specific change:

1. Click the vertical ellipses icon in the last column of the change.

2. Click Update Comment.

   The DMARC Action pop-up appears.

3. In the Comments field, enter the comments.

4. Click OK.