A few months ago, our friends over at BEMO cybersecurity paid us a huge compliment by blogging on two of our favorite topics, MxToolbox and implementing DMARC. Their blog,
Since not all outbound email configurations are the same, our delivery experts had a few thoughts to add…
Do you have Multiple Outbound Senders?
Most companies send corporate email from a centralized set of servers. Office 365 and Gmail do this for many companies, but you could also have an internal email setup like MS Exchange. However, many companies also employ one or many 3rd party email senders. For example:
- Marketing Automation (Marketo, Eloqua, Hubspot, etc.)
- Email Campaign Tools (MailChimps, Constant Contact, etc.)
- Customer Relationship Managers (Salesforce, Zoho, Microsoft Dynamics, etc.)
- Support Ticketing Systems (LiveAgent, ZenDesk, etc.)
- Order Management and Fulfillment
You will want these services to send email “from” your domain, so they need to be included in your SPF, DKIM and DMARC configurations. This will mean additional IP address ranges in your SPF record, additional DKIM keys setup and monitoring DMARC compliance for all your outbound email senders.
Do you send email from Multiple Domains?
Whether your company has acquisitions or other brands you wish to send email from, you may operate and email from multiple domains. For this type of configuration, you’ll need to configure SPF, DKIM and DMARC for each domain you send from. Similarly, MxToolbox Experts are finding that it has become more common to send email from a dedicated subdomain, like email.yourdomain.com. This also requires careful thought and may need additional SPF, DKIM and DMARC configuration.
Everyone should be looking at DMARC Reports
When you configure DMARC records there are two important tags that you can use to elicit feedback on your sent email from inbox providers – RUA and RUF.
RUA – List the email addresses you would like to receive SPF, DKIM and DMARC compliance information from inbox providers.
RUF – List the email addressed you would like to receive Forensic data on failed email from your domain.
These RUA and RUF reports are sent in XML format by each individual inbox provider. The information sent is highly valuable to protecting and improving your email deliverability. However, to gain insight from them, you need some way to aggregate these reports across all these inbox providers.
Go slowly on your road to Quarantine or Reject Policies
If you have a single sender setup, then you can go straight to Quarantine or Reject policies on DMARC without concern for a portion of your email being unfairly rejected. Most companies, though, have multiple outbound email senders. Before you commit to Quarantine or Reject, you need to ensure that all of your legitimate outbound email senders are sending SPF, DKIM and DMARC compliant email. If not, email from these sources may miss the inbox. It takes some time and effort to:
- Examine DMARC reports
- Uncover non-compliant senders
- Update each non-compliant configuration
- Evaluate the changes you made
Once you are confident that your legitimate email is getting through, the DMARC record enables you to set a percentage of your email to the Quarantine policy. Starting with a small fraction, like 10%, gives you the opportunity to detect any email that might go missing from customers’ inboxes. MxToolbox recommends a slow, iterative approach through Quarantine to Reject policies. Once you are at 100% Reject, MxToolbox recommends continual evaluation of your senders DMARC compliance.
Leverage MxToolbox SPF and DMARC record generators
As part of our suite of free tools, MxToolbox provides an SPF Record Generator and DMARC Record Generator tool. Use these to help you get the syntax of your DNS records correct, then use our check tools to that your DNS entries are properly detectable by the outside world.