DMARC Setting

[Uber22]

Hey

 

I staingly had an external IT company send in an email to say they had found we dont have DMARC Setup, I already have DKMI setup does anyone else have this setup in there environment ?

 

Any implication of not having it on

[Lister]

Hey Uber,

 

We are going through the motions of getting it all set up currently.

 

There are 3 parts to it: SPF, DKIM, DMARC.

 

SPF - A list of IP addresses approved for sending mail from that domain (Rule is put into DNS)

DKIM - A signature added to mail to prove it game from your mail servers

DMARC - A DNS Entry requesting reports on SPF/DKIM failures to be reported back to you. This also allows you to instruct recipients how to handle email that has failed (Nothing, Quarantine, Delete.) It is up to the person on the other end ultimately if they follow this up.

 

All of this is primarily aimed at protecting others from your domain being misused, not for protecting you directly. But the more people set it up, the lower the amount of spam. Its not perfect coverage & there are ways of still getting around it, but it helps.

 

There are services that can help set this up, particularly DMARC where you need somewhere for the reports to go and be made into information that is readable. The NCSC has a service called MailCheck that is free, its aimed at government/councils but schools can sign up, you just have to email them and ask.

[mavhc]

Does O365 send messages back to domains that O365 users receive email from, if the messages fail DMARC?

 

https://office365.uservoice.com/forums/289138-office-365-security-compliance/suggestions/11094318-dmarc-aggregate-reports-from-o365-domains

[MatthewL]

I'm having a bit of a mare setting up DKIM on my Office 365 setup, any advise?

[win]

It's to do with your external DNS rather than office 365. Just add a text entry like this (with your domain):

 

_DMARC.mydomain.uk. 3600 v=DMARC1;p=quarantine;pct=100;rua=mailto:[email protected]

 

Secure your email by following this:

 

https://nedimmehic.org/2019/02/04/configure-dkim-dmarc-in-office-365/

[kennysarmy]

Can anyone with a bit more knowledge than I on this subject check if these look correct before I get the SWGfL (RM) to make the changes?

 

DKIM Record : -

 

selector1._domainkey.balcarras.gloucs.sch.uk. 3600 IN TXT "selector1-balcarras-gloucs-sch-uk._domainkey.balcarrasgloucsschuk.onmicrosoft.com"

 

selector2._domainkey.balcarras.gloucs.sch.uk. 3600 IN TXT "selector2-balcarras-gloucs-sch-uk._domainkey.balcarrasgloucsschuk.onmicrosoft.com"

 

 

 

DMARC Record :-

 

_dmarc.balcarras.gloucs.sch.uk. 3600 IN TXT "v=DMARC1; p=reject; sp=none; pct=100; ri=86400; rua=mailto:[email protected]"

 

 

Many many thanks.

[HPlum78]

Ain't checked your records @kennysarmy (on my phone and it's a pain) but here are a few resources that may help you guys:

 

https://dmarcian.com/

Loads of good stuff here to help you create and test DKIM, DMARC and SPF

 

https://mxtoolbox.com/SuperTool.aspx

More tools for testing

 

And MS in the portal have got the tool that will create your DKIM records and allow you to rotate the keys and such likes.

 

And here is just one of many powershell scripts that you can point at the DMARC reporting mailbox to give you something readable.

 

https://gallery.technet.microsoft.com/scriptcenter/Harvest-DMARC-items-for-9c0d911a

[chaplic]

I wouldn't go for p=reject from the word go, I'd go for p=none, leave it a few weeks get some reports in and eyeball the results, in case there is valid mail being sent you're not aware of.

[HPlum78]

Yeah @chaplic is right reject is one way to sort the men from the boys! (or drop a load of mail at the door)

[MatthewL]

I have all mine working except DKIM, I have created these CNAME records but when I enabled it in the O365 it says they don't exist, have what am I missing?

 

_DMARC

v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; sp=none; fo=1:s

 

selector1

selector1-domain-co-uk._domainkey.domainname.tonmicrosoft.com

 

selector2

selector2-domain-co-uk._domainkey.domainname.onmicrosoft.com

 

domain = mydomain.co.uk

domainname = mydomain

[MatthewL]

When I enabled DKIM in O365 I get the following error:

 

CNAME record does not exist for this config. Please publish the following two CNAME records first. {0} {1}

[HPlum78]

Huh they (MS) where looking in to that i had opened a ticket something to do with moving the config from exo to the admin portal... Use the PowerShell command directly as there is no way to do it in the GUI when that error comes up from memory. (providing that it can find the required DNS records on you servers that is)

 

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/use-dkim-to-validate-outbound-email?view=o365-worldwide

 

The PS can be found in the above, but here it is:

New-DkimSigningConfig -DomainName {Domain for which config is to be created} -KeySize 2048 -Enabled $True

 

And the command reference is here:

https://docs.microsoft.com/en-us/powershell/module/exchange/new-dkimsigningconfig?view=exchange-ps

Edited January 11, 2021 by HPlum78

[MatthewL]

Resolved mine this morning, the cname wants to be selector1._domainkey and not selector1 then as above and it lets me enable it. Just need to let things refresh and I think its all good.

[MatthewL]

Thanks to @HPlum78 in this, Dmarcian site was a massive help and my domains are now sorted, slight issue with one domain which had a - in it, O365 has created some bits on the end for the DKIM record when creating the DNS records.

 

If anyone is struggling DNS entry wise give me a shout, the issue with O365 enabling has been fixed if you have the right records in place so its a good test if you have got them right.

 

Using Dmarcian I have checked a few public organisations that I deal with, very few have DMARC, SPF & DKIM all setup properly or are nearly there but have errors in it. This is something I have been working on for ages but had issues so glad to get it all done and sorted now.

[kennysarmy]

If anyone can help me with decoding the results of the DMARC Aggregate Reports I'd be grateful.

 

I've uploaded one to here : https://us.dmarcian.com/xml-to-human-converter/?_ga=2.137650032.1190586516.1610623329-1692370571.1610118532

 

[mavhc]

Looks like mailchimp tried to send an email as your domain, do you use mailchimp?