IT Toolbox
Menu
Français
HomeHow to deploy DMARC gradually without blocking legitimate emails
Guide

How to deploy DMARC gradually without blocking legitimate emails

A DMARC policy must be gradually deployed to identify all legitimate sources before moving to the quarantine or the mundane

TopicIT resources → About 1 min read

A DMARC policy must be gradually deployed to identify all legitimate sources before moving to the quarantine or the mundane.

Steps.

  1. Inventory senders. — List Microsoft 365, CRM, website, marketing tools and business applications.
  2. Validate SPF and DFIM — Each source must properly align SPF or DHIM with the From domain.
  3. Start observation — Publish p=none with a dedicated reporting address.
  4. Analyze reports. – Correct unaligned sources and forgotten services.
  5. Stepwise strengthening. — Go to the quarantine and then to the mundane only when legitimate traffic is controlled.

Commands

nslookup -type=txt _dmarc.exemple.fr
nslookup -type=txt exemple.fr

Key takeaways

  • DMARC does not replace SPF or DFIM.
  • Avoid exceeding the SPF DNS search limits.
  • Do not post p=reject on the first day on a complex active domain.

Related resources

Relevant topic Deploy DMARC in reject mode Controlled procedure to set up dmarc in the mundane mode Relevant topic DMARC A policy DNS which combines SPF and DKIM to combat the usurpation of email domains.
Support the development of BAOI Hosting, domains and new IT resources.
❤️ Support BAOI

My favorites