{"id":403,"date":"2021-03-31T06:16:42","date_gmt":"2021-03-31T06:16:42","guid":{"rendered":"https:\/\/prodmarc.com\/blog\/?p=403"},"modified":"2022-07-28T06:20:22","modified_gmt":"2022-07-28T06:20:22","slug":"dmarc-deployment-mistakes","status":"publish","type":"post","link":"https:\/\/testblog.prodmarc.com\/index.php\/2021\/03\/31\/dmarc-deployment-mistakes\/","title":{"rendered":"DMARC Deployment Mistakes Companies Make During Implementation"},"content":{"rendered":"\n\n\n
\"\"<\/figure>\n\n\n\n

Domain-based Message Authentication Reporting & Conformance, or DMARC<\/strong>, protects an organization’s trusted domains from email spoofing. Due to the exponential growth of email fraud, and the fact that domain spoofing attacks account for a significant percentage of these attacks, it’s no wonder that many businesses are looking to introduce DMARC authentication to ensure that emails sent on their behalf are legitimate.<\/p>\n\n\n\n

<\/div>\n\n\n\n

In fact, the Department of Homeland Security recently required that all civilian government agencies complete the DMARC implementation<\/strong> within a short timeframe, and urged private companies to do the same.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Many companies have not yet adopted DMARC because it is difficult to enforce and there is a high risk of DMARC problems, such as blocking legitimate email. To better help companies and agencies protect their trusted domains, we have identified five common mistakes made when deploying DMARC authentication.<\/strong><\/p>\n\n\n\n

<\/div>\n\n\n\n

Mistake #1: Don\u2019t account for all legitimate mail streams, including third-party senders<\/strong><\/p>\n\n\n\n

Many senders, including third parties, send emails on behalf of other organizations. It can be difficult to recognize all of the legitimate senders, particularly when various departments within a company use third party email senders, such as marketing, sales, and human resources. <\/p>\n\n\n\n

<\/div>\n\n\n\n

However, if all legitimate senders are not detected and allowed to send an email on behalf of the company, essential communications may be blocked, causing business disruption. Stakeholders from all related agencies should be consulted and active.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Mistake #2: Let a subdomain inherit the top-level domain\u2019s policy<\/strong><\/p>\n\n\n\n

DMARC implementation is usually focused on the top-level domain (ex: acme.com), and organizations can neglect the importance of configuring unique policies for each of their subdomains (ex: mail.acme.com). The DMARC policy that is applied to the top-level domain is immediately applied to subdomains. If all subdomains are separately accounted for, this can result in accidental blocking of legitimate email.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Mistake #3: Don\u2019t have a system or tool in place to parse the data from DMARC records<\/strong><\/p>\n\n\n\n

The receiving email service providers’ DMARC aggregate reports provide important details about your email ecosystem, but they are not easy to understand. If you can arrange data in a way that adds meaning, it’s just data. Furthermore, keeping up with the sheer volume of reports sent and collating all of the data in a timely way can be difficult.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Mistake #4: Don\u2019t understand SPF and DKIM alignment<\/strong><\/p>\n\n\n\n

DMARC alignment <\/strong>prevents spoofing of the \u201cheader from\u201d address by:<\/p>\n\n\n\n

<\/div>\n\n\n\n
  1. Matching the \u201cheader from\u201d domain name with the \u201cMFROM\u201d domain name used during an SPF check, and<\/li>
  2. Matching the \u201cheader from\u201d domain name with the \u201cd=domain name\u201d in the DKIM signature.<\/li><\/ol>\n\n\n\n
    <\/div>\n\n\n\n

    Proper alignment guarantees that the transmitting identity is authenticated in relation to the domain that it appears to be. Third-party email senders, once again, present additional obstacles. Third-party vendors, for example, typically have their own \u201cMFROM\u201d domain. As a result, they pass SPF but not SPF alignment. DKIM is in the same boat. DKIM can be passed by third-party vendors, but not DKIM alignment.<\/p>\n\n\n\n

    <\/div>\n\n\n\n

    Mistake #5: Use improper DMARC syntax or content<\/strong><\/p>\n\n\n\n

    Although there are instructions for generating DMARC records<\/strong>, they can be confusing at times. Improper formatting and\/or content, as well as incorrect policy values, are also popular. To prevent DMARC issues, keep the following in mind:<\/p>\n\n\n\n

    <\/div>\n\n\n\n