Popular Post TechMonkey Posted November 1, 2021 Popular Post Posted November 1, 2021 Just found this elsewhere - https://www.learndmarc.com/ You send an email to them and they step through validating SPF, DKIM and DMARC as it goes through your email headers. Makes the process a bit more visual so easier to understand and should help troubleshooting a new set up. A bit twee in its UI and a bit slow as it goes through its script but interesting. 13
chaplic Posted November 2, 2021 Posted November 2, 2021 NCSC offer a mailcheck service which is free to various government bodies and the like, it checks all your SPF and will accept and aggregate DMARC reports - and it's free. Thoroughly recommend
free780 Posted November 2, 2021 Posted November 2, 2021 Just found this elsewhere - https://www.learndmarc.com/ You send an email to them and they step through validating SPF, DKIM and DMARC as it goes through your email headers. Makes the process a bit more visual so easier to understand and should help troubleshooting a new set up. A bit twee in its UI and a bit slow as it goes through its script but interesting. This is really useful for getting an understanding or having to explain the need for SPF,DKIM and DMARC to managers etc In larger organisations different departments will sign up for mailchimp etc and send spoofed email with no consideration of the security concerns.
jthompson Posted November 2, 2021 Posted November 2, 2021 NCSC offer a mailcheck service which is free to various government bodies and the like, it checks all your SPF and will accept and aggregate DMARC reports - and it's free. Thoroughly recommend +1 for NCSC mail check. You can really drill down into the DMARC statistics nicely once it has enough days' worth of reports, and it'll help with MTA-STS stuff. I've been using Postmark's free summaries service for a while now, but NCSC's service is a nice upgrade from that. One cool thing that the learndmarc tool did when I tried it was point out that I had no adkim (strict/relaxed DKIM alignment) in my policy.
Edu-IT Posted March 10, 2022 Posted March 10, 2022 Has anyone implemented the MTA-STS part of NCSC Mail Check? We have a managed website so it's not that easy to create the file needed and wonder how others have achieved it if so.
free780 Posted March 10, 2022 Posted March 10, 2022 Has anyone implemented the MTA-STS part of NCSC Mail Check? We have a managed website so it's not that easy to create the file needed and wonder how others have achieved it if so. Not done it yet. But would need to set a web server with inbound access in the DMZ. Its a shame that requirement is there as smaller organisations won't be able to implement it without a web server somewhere.
jthompson Posted March 10, 2022 Posted March 10, 2022 It can get a bit complicated, but we were in the same position as you with regard to our main website being managed for us (i.e. no access to manage files on the web server). We have an account with Krystal for hosting a couple of other little bits, and so we've hosted our MTA-STS file on there. The domain is added to our Krystal account as an add-on domain, and then we've made the relevant DNS entries to point to Krystal servers. The MTA-STS DNS record for you domain can point to wherever you need it to: that doesn't necessarily have to be the same servers as your www site.
andy_b Posted March 10, 2022 Posted March 10, 2022 Apparently you can also use Azure Static web apps to host the file - but I haven't really looked into this yet: https://blog.jonsdocs.org.uk/2022/01/08/setting-up-mta-sts-using-azure-static-web-apps/
HPlum78 Posted March 10, 2022 Posted March 10, 2022 This one is also useful https://www.mail-tester.com/
fiza Posted May 6, 2022 Posted May 6, 2022 I would like to implement MTA-STS but we have no public webserver where we can host the policy file. I look after 3 sites so would need to host 3 policy files and thus create 3 subdomains. Does anyone know of a web host that won't break the bank just to host 3 text files?
colly72 Posted May 6, 2022 Posted May 6, 2022 I would like to implement MTA-STS but we have no public webserver where we can host the policy file. I look after 3 sites so would need to host 3 policy files and thus create 3 subdomains. Does anyone know of a web host that won't break the bank just to host 3 text files? This might help: https://github.com/jpawlowski/mta-sts.template 2
fiza Posted May 9, 2022 Posted May 9, 2022 This might help: https://github.com/jpawlowski/mta-sts.template Thank you!!! This has worked perfectly. 2
Sydders01 Posted May 9, 2022 Posted May 9, 2022 This is a brilliant piece of information. Please guys which of these three is a legal requirement for your organization- SPF or DMARC or DKIM Thanks
jthompson Posted May 9, 2022 Posted May 9, 2022 None are legal requirements, but you'd need SPF and DKIM set up before you can make use of DMARC, since they're prerequisistes for it.
DGardiner Posted May 9, 2022 Posted May 9, 2022 This is a brilliant piece of information. Please guys which of these three is a legal requirement for your organization- SPF or DMARC or DKIM Thanks None, they each in turn make it more difficult to spoof your companies emails If youre just starting out SPF + DKIM is the starting point, running a mail service without these is silly. DMARC is more difficult and requires a bit of planning testing to not accidentally kill your emails but well worth doing https://www.compassitc.com/blog/what-are-dkim-spf-and-dmarc
Michael Posted May 9, 2022 Posted May 9, 2022 DMARC's enabled by default on O365 inbound email. It's more a question whether you want DMARC on your organisation's outbound email. SPF is also enabled as standard too. I created a guide (it was for Arbor), but describes how to enable DKIM (the first part).
jthompson Posted May 9, 2022 Posted May 9, 2022 That's a good point, actually. If you're using Google or O365 for your email, inbound emails will still all be being checked against SPF, DKIM and DMARC and processed accordingly (or near enough), as part of the email filtering that those platforms are already providing, regardless of whether you've configured SPF, DKIM and DMARC on your own email domain name(s) or not. You set up DMARC as much to prevent people you have no absolutely no connection with from receiving emails that are spoofing your domain, as much as you do it to protect your own users. If you're using O365, say, then having DMARC set up well will mean that random Gmail, Yahoo or AOL users in other parts of the world won't be receiving any spam that's pretending to be from your domain. The reporting aspect of DMARC gives you some visibility on the amount of those emails that are being sent around the world, that you otherwise would be completely oblivious to.
chekmate1984 Posted December 6, 2022 Posted December 6, 2022 Hi Would the below youtube link be good as base to setup dkim spf for a office 365 school? https://www.youtube.com/watch?v=OM-WpyBHsB0
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now