SPF, DKIM and DMARC walkthrough and tester

[TechMonkey]

Just found this elsewhere - https://www.learndmarc.com/

 

You send an email to them and they step through validating SPF, DKIM and DMARC as it goes through your email headers. Makes the process a bit more visual so easier to understand and should help troubleshooting a new set up. A bit twee in its UI and a bit slow as it goes through its script but interesting.

[chaplic]

NCSC offer a mailcheck service which is free to various government bodies and the like, it checks all your SPF and will accept and aggregate DMARC reports - and it's free. Thoroughly recommend

[free780]

Just found this elsewhere - https://www.learndmarc.com/

 

You send an email to them and they step through validating SPF, DKIM and DMARC as it goes through your email headers. Makes the process a bit more visual so easier to understand and should help troubleshooting a new set up. A bit twee in its UI and a bit slow as it goes through its script but interesting.

 

This is really useful for getting an understanding or having to explain the need for SPF,DKIM and DMARC to managers etc

 

In larger organisations different departments will sign up for mailchimp etc and send spoofed email with no consideration of the security concerns.

[chazzy2501]

pretty cool!

[jthompson]

NCSC offer a mailcheck service which is free to various government bodies and the like, it checks all your SPF and will accept and aggregate DMARC reports - and it's free. Thoroughly recommend

 

+1 for NCSC mail check. You can really drill down into the DMARC statistics nicely once it has enough days' worth of reports, and it'll help with MTA-STS stuff. I've been using Postmark's free summaries service for a while now, but NCSC's service is a nice upgrade from that.

 

One cool thing that the learndmarc tool did when I tried it was point out that I had no adkim (strict/relaxed DKIM alignment) in my policy.

[Edu-IT]

Has anyone implemented the MTA-STS part of NCSC Mail Check? We have a managed website so it's not that easy to create the file needed and wonder how others have achieved it if so.

[free780]

Has anyone implemented the MTA-STS part of NCSC Mail Check? We have a managed website so it's not that easy to create the file needed and wonder how others have achieved it if so.

 

 

Not done it yet. But would need to set a web server with inbound access in the DMZ. Its a shame that requirement is there as smaller organisations won't be able to implement it without a web server somewhere.

[jthompson]

It can get a bit complicated, but we were in the same position as you with regard to our main website being managed for us (i.e. no access to manage files on the web server). We have an account with Krystal for hosting a couple of other little bits, and so we've hosted our MTA-STS file on there. The domain is added to our Krystal account as an add-on domain, and then we've made the relevant DNS entries to point to Krystal servers. The MTA-STS DNS record for you domain can point to wherever you need it to: that doesn't necessarily have to be the same servers as your www site.

[andy_b]

Apparently you can also use Azure Static web apps to host the file - but I haven't really looked into this yet:

 

https://blog.jonsdocs.org.uk/2022/01/08/setting-up-mta-sts-using-azure-static-web-apps/

[HPlum78]

This one is also useful

https://www.mail-tester.com/

[fiza]

I would like to implement MTA-STS but we have no public webserver where we can host the policy file. I look after 3 sites so would need to host 3 policy files and thus create 3 subdomains. Does anyone know of a web host that won't break the bank just to host 3 text files?

[colly72]

I would like to implement MTA-STS but we have no public webserver where we can host the policy file. I look after 3 sites so would need to host 3 policy files and thus create 3 subdomains. Does anyone know of a web host that won't break the bank just to host 3 text files?

 

This might help:

 

https://github.com/jpawlowski/mta-sts.template

[fiza]

This might help:

 

https://github.com/jpawlowski/mta-sts.template

 

Thank you!!! This has worked perfectly.

[Sydders01]

This is a brilliant piece of information. Please guys which of these three is a legal requirement for your organization- SPF or DMARC or DKIM

Thanks

[jthompson]

None are legal requirements, but you'd need SPF and DKIM set up before you can make use of DMARC, since they're prerequisistes for it.

[DGardiner]

This is a brilliant piece of information. Please guys which of these three is a legal requirement for your organization- SPF or DMARC or DKIM

Thanks

 

None, they each in turn make it more difficult to spoof your companies emails

 

If youre just starting out

 

SPF + DKIM is the starting point, running a mail service without these is silly.

 

DMARC is more difficult and requires a bit of planning testing to not accidentally kill your emails but well worth doing

 

https://www.compassitc.com/blog/what-are-dkim-spf-and-dmarc

[Michael]

DMARC's enabled by default on O365 inbound email. It's more a question whether you want DMARC on your organisation's outbound email.

 

SPF is also enabled as standard too.

 

I created a guide (it was for Arbor), but describes how to enable DKIM (the first part).

[jthompson]

That's a good point, actually. If you're using Google or O365 for your email, inbound emails will still all be being checked against SPF, DKIM and DMARC and processed accordingly (or near enough), as part of the email filtering that those platforms are already providing, regardless of whether you've configured SPF, DKIM and DMARC on your own email domain name(s) or not.

 

You set up DMARC as much to prevent people you have no absolutely no connection with from receiving emails that are spoofing your domain, as much as you do it to protect your own users. If you're using O365, say, then having DMARC set up well will mean that random Gmail, Yahoo or AOL users in other parts of the world won't be receiving any spam that's pretending to be from your domain. The reporting aspect of DMARC gives you some visibility on the amount of those emails that are being sent around the world, that you otherwise would be completely oblivious to.

[chekmate1984]

Hi

 

Would the below youtube link be good as base to setup dkim spf for a office 365 school?

 

https://www.youtube.com/watch?v=OM-WpyBHsB0