Let me add a few thoughts here about our SPF/DKIM/DMARC experiences over the last 3 years. This document will be edited as more information becomes available...
Outbound Traffic - active domains
Make sure your SPF records are correct and contain at least all your mail servers as well as all the known external service providers sending emails in your behalf. Make sure to review your SPF record every 3 months.
Make sure you sign every outbund email with a DKIM key. Roll over those keys at least on a yearly basis. We have two DKIM keys per domain, one per user initaited emails and one for system initiated emails.
Make sure your DMARC records are are at least in monitoring mode for the main and all subdomains.
Inbound Traffic - active domains
Step 1 :
Validate PTR, SPF and DKIM
Create a bad PTR sender policy and add all business critical senders into this policy so they can bypass PTR checks.
Create a bad SPF or none sender policy and add all business critcial senders into this policy so they can bypass SPF checks. We use a message filter to keep a copy of such emails and drop SPF status of Fail,PermError, SoftFail and TempError for HELO, MAILFROM and PRA.
Create a bad DKIM or none sender policy and add all business critcial senders into this policy so they can bypass DKIM checks. We also use a message filter to keep such emails and drop DKIM status of Fail.
Create a bad ARC or non sender policy and just add bad ARC senders/verdicts into this policy. We will at a later step create a message filter to validate or reject ARC headers.
Create a policy called SenderInventory and add all existing known good senders to that policy. Make sure you exclude this policy from DMARC checks.
Step 2 :
Change your DMARC DNS records at least for monitoring mode of main and subdomains. Send the RUA and RUF records to a well known DMARC Aggregator as it is simply not possible to do this task without the help of them.
Options we have tested and are working are:
DMARCIAN
DmarcAnalyzer
MXToolbox DMARC
Agari DMARC
Proofpoint DMARC
Valimail DMARC
Pricing depends on # of email domains and volume of email.
What you mainly need to get out over at least a 3 month period is a good sender inventory of all valid internal and external senders sending emails in your behalf. Add them to the SenderInventory policy.
Step 3 :
Change the setup of your ESA so that every incoming and outcoming email is handled by them. Dont worry about systems like O365 which are already signing email messages with DKIM as you will most likely just sign them again and remove existing signatures.
Step 4 :
if your sender inventory is complete change the DMARC setup of your ESA to honor the rejection of any DMARC enable senders. This is also the moment where you should start changing your DMARC records action from None to Q first and to Q later.
I call this kind of setup SmartDMARC as you are not fully implementing DMARC for inbound until you have a good enough sender inventory, but can you go into Outbound Reject mode very quickly once you feel confident about your sender lists. For larger domains with many external senders this is the best way to go forward without impacting email delivery.
Please feel free to comment and I will try to answer
-Marc
