Microsoft has made improvements to its DMARC policy management, enhancing the tools available to administrators that aim to block malicious emails from reaching users.
The protocol known as Domain-based Message Authentication, Reporting and Conformance, or DMARC, is designed to authenticate emails, helping to thwart spoofing and phishing by confirming the sender’s domain authenticity. Recently, Microsoft has updated the way DMARC policies are handled in Exchange Online on its Microsoft 365 platform, offering users increased control over emails that fail DMARC verification, along with improved insights into suspicious activities through advanced reporting features. The updated article discusses these new features and discusses ways to tailor these settings for specific organizational needs.
DMARC aids in the email verification process by providing guidelines set in the DNS records by the sender’s Exchange administration on how emails failing verification should be managed by the recipient’s domain, which verifies incoming emails based on the sender’s DMARC policy.
This cooperative practice is vital in preventing spoofing and maintaining the authenticity of the sending organization.
The core elements of DMARC include:
DMARC helps reduce spoofing and unauthorized use of domains, lessening phishing attacks that seem to come from trusted sources to deceive recipients into giving away confidential information or engaging in harmful activities.
In 2023, Microsoft enhanced its DMARC policy settings for better enforcement, ensuring a reject DMARC policy truly blocks emails. Previously, even with a reject policy, emails failing DMARC checks could still be directed to users’ junk or spam folders due to Microsoft treating the reject policy as a quarantine policy, potentially putting the organization at risk by letting through phishing attempts.
When an organization enforces a reject policy on emails failing authentication, they receive a nondelivery report detailing why the email was blocked.
Microsoft 365 by default adheres to the sender’s DMARC policy, but administrators have the option to modify these settings through the anti-phishing policy in the admin portal. For instance, in situations where there is a surge in phishing attempts, administrators could opt to enforce stricter measures like quarantining emails coming from specific domains.
DMARC is an integral part of a comprehensive email security plan. It should be implemented alongside other security practices such as staff awareness programs, the use of anti-phishing tools, periodic security evaluations, and multifactor authentication. This multi-layered approach significantly enhances the protection against email-centric security threats.
The adoption of a DMARC policy offers numerous advantages to the originating organization. It helps in preventing the misuse of the domain by malicious entities, ensures emails are more likely to be delivered to the intended recipient’s inbox instead of the spam folder, and provides valuable feedback to Exchange administrators about the reasons for email authentication failures and their resolutions.
To implement a DMARC policy, it is important to first gain a solid understanding of your email environment, including the way emails are sent, the domains involved, and the authentication protocols in place.
Managing DMARC effectively necessitates an understanding of DNS management and email authentication methods, essential for tailoring DMARC to your organization’s needs while ensuring that valid email communication is not disrupted. For administrators who are less experienced with DMARC, utilizing a DMARC analyzer tool can aid in verifying the correctness of your DMARC policy settings.
Establish a DMARC TXT record within your domain’s DNS configurations. This record will outline the policies to be applied to emails that do not pass DMARC authentication and establishes preferences for reporting mechanisms to monitor and assess these discrepancies:
Aggregate reports, identified by the rua tag (Reporting URI for Aggregate), provide a summary of your domain’s email traffic, highlighting details about the authentication outcomes. These reports are crucial for pinpointing originating sources of emails, their authentication statuses, and any other potential issues.
Forensic reports marked by the ruf tag (Reporting URI for Forensic), offer comprehensive insights about particular emails that failed DMARC checks, including extensive data on message headers and content. Such detailed reports are valuable for troubleshooting authentication problems or spotting harmful email activities.
Begin by setting up DMARC with a policy of “none” (p=none) to keep an eye on the flow of your emails. Use this period to gather and analyze reports, pinpointing approved senders and identifying sources behind failed authentications.
Shift to a more stringent policy after your initial observations. Depending on the outcomes from the initial phase, modify your DMARC settings to either “quarantine” (p=quarantine) or “reject” (p=reject) to enhance security. It is crucial to ensure that your legitimate email sources comply with these changes to prevent interruptions in email delivery.
Continually examine DMARC reports to prevent issues related to email delivery. Tweak policies as necessary to strike a balance between securing your email environment and maintaining smooth legitimate communications.
To implement a DMARC policy on Microsoft 365, previously known as Office 365, please follow the provided instructions:
To monitor and manage DMARC configurations effectively, it’s essential to enable report generation in your DMARC policy and designate where these reports should be sent. These reports are generally provided in XML format.
The DMARC reports offer insights into email authentication status, showcasing both successful and failed checks alongside the IP addresses from which the emails originate. While Microsoft does not provide a specific tool for DMARC analysis, various third-party services such as Dmarcian, URIports, and EasyDMARC are available to help understand and utilize the data contained in DMARC reports.
Regularly reviewing these reports is crucial for tracking authentication trends, pinpointing sources of failed authentication, and detecting possible spoofing activities.
It is important to take corrective measures in response to the findings of these reports by modifying SPF and DKIM settings and investigating any suspicious email origins.
By regularly analyzing DMARC reports and using tools to interpret the data, you can gain insights into your email ecosystem’s health, identify potential threats and take appropriate measures to enhance email authentication and security.
Helen Searle-Jones holds a group head of IT position in the manufacturing sector and has more than 25 years of experience with managing a wide range of Microsoft technologies in the cloud and on premises.