DMARC understanding / setup

[cyberurmel]

Hello all, 

hope you can help me to get a bit further in this case. Version 16 of the ESA Cluster. 

So i have implemeted DMARC / DKIM /SPF  from internal mails which sended in our SPF IPs hosts. 

Currently to check as we have it as new feature with none action for MTAs outside . Seems to work fine except as i have to look up for a program which helps to handle the incoming reports better than look one on one inside .

ok.. now i am a bit hanging in how to setup the incoming mails at first step : 

as i tested a few hours .. i checked in the mail flow policies :

dkim verification 

spf verification 

dmarc verification 

to on and in the global dmarc setting all to a quarantine which i created. 

That seems to work but have some false /positives and not the time for checking up them all. 

So disabled everything to that .

My question(s) :

- Was that basically the right way? 

- Is it possible to pass the mail if spf is correct or DKIM ? Only Quarantine if both fails? 

- i found a document with spf / dkim fails monitoring on content filter. Means that that i can configure that , the mails are running through i.e. but i see that in this monitoring what was the issue? 

- understood i right that if someone sends via webgui from a different server (SPF is entry) i can make a bypass for dkim for this domain / MTA ? 

thanks a lot for help

Regards

[Dustin Anderson]

So, from the way we handle it incoming, we look at SPF/DKIM/DMARC as a security setting on the senders side and we do not change or bypass it. What I mean by that is if it fails and a customer contacts us, we give them the info and let them correct the issue. we do not whitelist or bypass since if the security is failing, we can't verify the request is legitimate.

to avoid spam and spoofed emails, I would leave DMARC on as you had and honor the customers setting to quarantine or reject. You should not get false positives and anything that you believe are would be a misconfiguration on the customers side they need to correct. It's not for you to bypass their issue as they will have the same problem with most places they email.

Now, since we do this, we have a postmaster account that has a bypass for all filters so they can email us and we can get them info if it is stuff they need to correct.

So, just for scale, in the last 24 hours, we had 208K emails attempted with only 130K being clean and allowed through.so almost a 40% spam/scam filter rate.

[cyberurmel]

Hello Dustin ,

thanks at first for your info.  Could you be so kind to explain my questions or answer it? Thanks a lot 

The bypass  i meant would be only for 1-2 Formulars which are hosted on another company server but in our name. So perhaps its a bit tricky to get one who can handle a dkim entry. SPF is set for the server in our DNS Entry.

- Is it possible to pass the mail if spf is correct or DKIM ? Only Quarantine if both fails? 

- i found a document with spf / dkim fails monitoring on content filter. Means that that i can configure that , the mails are running through i.e. but i see that in this monitoring what was the issue? 

- understood i right that if someone sends via webgui from a different server (SPF is entry) i can make a bypass for dkim for this domain / MTA ? 

- Do you know a free tool (for the start which can handle the lots of xml/gzip information sent to us) ?

Thanks a lot 

Regards

[Dustin Anderson]

Hey, I'll answer the best I know.

The bypass  i meant would be only for 1-2 Formulars which are hosted on another company server but in our name. So perhaps its a bit tricky to get one who can handle a dkim entry. SPF is set for the server in our DNS Entry.

     So, what we do at our business is we do subdomains for any 3rd party emailing as us. This allows for separate SPF and DKIM/DMARC

- Is it possible to pass the mail if spf is correct or DKIM ? Only Quarantine if both fails? 

Not really, if SPF fails and they have a -all, it's an auto reject. It'll only pass if their record ends with ~all. But, I'm not sure with where the reject/bounce happens since you can do SPF/DKIM content filters, so may need to test. I'm not sure if it works, or need to disable checking in the mail flow policy.

- i found a document with spf / dkim fails monitoring on content filter. Means that that i can configure that , the mails are running through i.e. but i see that in this monitoring what was the issue? 

If you are talking logs, it'll just say SPF or DKIM fail, or softfail. You will not get more than that and have to do some legwork.

- understood i right that if someone sends via webgui from a different server (SPF is entry) i can make a bypass for dkim for this domain / MTA ? 

So, it is not recommended to whitelist a sending domain, but the actual email servers they are using. Otherwise a spoof message could be allowed.

- Do you know a free tool (for the start which can handle the lots of xml/gzip information sent to us) ? We use Valimail, I believe they have a free option.