{"id":208,"date":"2017-06-17T10:20:00","date_gmt":"2017-06-17T04:50:00","guid":{"rendered":"https:\/\/www.tikaj.com\/?p=208"},"modified":"2023-04-06T01:52:30","modified_gmt":"2023-04-05T20:22:30","slug":"7-mistakes-while-implementing-dmarc","status":"publish","type":"post","link":"https:\/\/www.tikaj.com\/blog\/7-mistakes-while-implementing-dmarc\/","title":{"rendered":"DMARC: 7 Mistakes while Implementing DMARC"},"content":{"rendered":"\n<p>DMARC, or Domain-based Message Authentication Reporting &amp; Compliance, protects corporate trusted domains from email spoofing attacks. Due to the rapid expansion of <a href=\"https:\/\/www.tikaj.com\/blog\/how-to-identify-a-phishing-email\/\" data-type=\"URL\" data-id=\"https:\/\/www.tikaj.com\/blog\/how-to-identify-a-phishing-email\/\">Email fraud<\/a> and the fact that domain spoofing attacks make up a large percentage of these attacks, it is no surprise that many organizations are looking to implement DMARC authentication to validate emails sent on their behalf. Following the 5 common mistakes to avoid when deploying Domain-based Message Authentication Reporting &amp; Compliance. <\/p>\n\n\n\n<div class=\"wp-block-rank-math-toc-block\" id=\"rank-math-toc\"><h2>Table of Contents<\/h2><nav><ul><li><a href=\"#1-dont-account-for-all-valid-mail-sources-like-third-party-senders\">1. Don&#8217;t account for all valid mail sources, like third party senders <\/a><\/li><li><a href=\"#2-dont-set-up-inactive-domains\">2. Don&#8217;t set up inactive domains <\/a><\/li><li><a href=\"#3-let-a-subdomain-comprise-the-rule-of-the-top-level-domain\">3. Let a subdomain comprise the rule of the top-level domain <\/a><\/li><li><a href=\"#4-in-your-spf-file-more-than-10-lookups\">4. In your SPF file, more than 10 lookups<\/a><\/li><li><a href=\"#5-not-using-dkim-signature\">5. Not using DKIM signature <\/a><\/li><li><a href=\"#6-not-working-on-your-alignment\">6. Not working on your alignment <\/a><\/li><li><a href=\"#7-using-wrong-syntax\">7. Using wrong syntax <\/a><\/li><\/ul><\/nav><\/div>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"alignright size-medium\"><img fetchpriority=\"high\" decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/www.tikaj.com\/wp-content\/uploads\/sites\/12\/DMARC-300x300.jpg\" alt=\"DMARC\" class=\"wp-image-3647\" srcset=\"https:\/\/www.tikaj.com\/wp-content\/uploads\/sites\/12\/DMARC-300x300.jpg 300w, https:\/\/www.tikaj.com\/wp-content\/uploads\/sites\/12\/DMARC-1024x1024.jpg 1024w, https:\/\/www.tikaj.com\/wp-content\/uploads\/sites\/12\/DMARC-150x150.jpg 150w, https:\/\/www.tikaj.com\/wp-content\/uploads\/sites\/12\/DMARC-768x768.jpg 768w, https:\/\/www.tikaj.com\/wp-content\/uploads\/sites\/12\/DMARC-1536x1536.jpg 1536w, https:\/\/www.tikaj.com\/wp-content\/uploads\/sites\/12\/DMARC-24x24.jpg 24w, https:\/\/www.tikaj.com\/wp-content\/uploads\/sites\/12\/DMARC-36x36.jpg 36w, https:\/\/www.tikaj.com\/wp-content\/uploads\/sites\/12\/DMARC-48x48.jpg 48w, https:\/\/www.tikaj.com\/wp-content\/uploads\/sites\/12\/DMARC.jpg 2000w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/figure><\/div>\n\n\n<h3 class=\"wp-block-heading\" id=\"1-dont-account-for-all-valid-mail-sources-like-third-party-senders\">1. Don&#8217;t account for all valid mail sources, like third party senders <\/h3>\n\n\n\n<p>Many organizations have many senders, including third parties, to send emails on their behalf. It may be difficult to locate all valid senders, especially given that different departments within the organization use third-party email senders. Furthermore, if not all appropriate senders are detected and allowed to send emails on behalf of the company, essential messages may be interrupted, possibly damaging the enterprise. Organizations will ensure that members from all related areas are updated and active. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"2-dont-set-up-inactive-domains\">2. Don&#8217;t set up inactive domains <\/h3>\n\n\n\n<p>Many if not all organizations have inactive domains and they do not enforce DMARC for them. Not setting up DMARC for inactive domains is a common error. You may not be sending emails to your parked domains, but someone might be exploiting the domain. Since these domains are not running, it is easy to protect these domains. Do not miss these domains in the DMARC implementation plan. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"3-let-a-subdomain-comprise-the-rule-of-the-top-level-domain\">3. Let a subdomain comprise the rule of the top-level domain <\/h3>\n\n\n\n<p>Usually, the company targets the DMARC implantation on the top-level domain and can easily avoid configuring specific policies for each of its sub-domains. When this framework is applied to the top-level domains it trickles down to subdomains automatically. This may allow legal email to be inadvertently blocked unless all subdomains are listed separately. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"4-in-your-spf-file-more-than-10-lookups\">4. In your SPF file, more than 10 lookups<\/h3>\n\n\n\n<p>A common mistake is to have more than 10 lookups in your <a href=\"https:\/\/www.tikaj.com\/blog\/what-is-spf-why-use-spf-what-are-its-limitations\/\" data-type=\"post\" data-id=\"423\">SPF<\/a> file. SPF helps the load on the email receiver side to be minimized by up to 10&#8242; lookups.&#8217; If you have more than 10 requests, the products may not qualify as legitimate SPF sources after the 10th quest. If you have more than 10 requests, the number of searches will need to be through. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"5-not-using-dkim-signature\">5. Not using DKIM signature <\/h3>\n\n\n\n<p>DKIM is one of two methods for encryption to render DMARC compatible messages. DMARC Analyzer advises signing outgoing emails with a DKIM signature from your direct mail outlets. Using DKIM will not only make DMARC compliant with your emails, but it will also help with transmission problems. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"6-not-working-on-your-alignment\">6. Not working on your alignment <\/h3>\n\n\n\n<p>An important aspect of DMARC is to ensure that the message&#8217;s correct source is the email in the&#8217; From&#8217; header. Senders were tested using DKIM and SPF. Alignment ensures that the term&#8217; From&#8217; fits the domain that is sent. We often see businesses change their strategies while not yet fully aligned with DKIM and SPF. This is a common error. Until modifying the DMARC rule, please make sure your DKIM and SPF are fully aligned. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"7-using-wrong-syntax\">7. Using wrong syntax <\/h3>\n\n\n\n<p>Although guidelines are accessible to set up DMARC records, they can be vague at times. Inaccurate formatting and\/or text and inaccurate rule principles are often common. <br><strong>A couple of important items to consider:  <\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use the right policy principles <\/li>\n\n\n\n<li>Test the typos <\/li>\n\n\n\n<li>Missing characters or extra characters<\/li>\n\n\n\n<li>If you have multiple reporting addresses separated with a comma, don\u2019t include a space after the comma, and ensure the second address starts with Mail To <\/li>\n<\/ul>\n\n\n\n<p>Easy to implement solutions to thwart threats and meet compliance requirements.<\/p>\n\n\n\n<p>TIKAJ&#8217;s DMARC Solution also includes DMARC Inspector, DKIM Inspector, SPF Inspector &amp; Validator.<\/p>\n\n\n\n<p>Get a free <a href=\"https:\/\/www.dmarcplus.com\/\" data-type=\"URL\" data-id=\"https:\/\/www.dmarcplus.com\/\" target=\"_blank\" rel=\"noopener\">DMARCPlus<\/a> consultation call from our experts.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>DMARC, or Domain-based Message Authentication Reporting &amp; Compliance, protects corporate trusted domains from email spoofing attacks. Due to the rapid expansion of [&hellip;]<\/p>\n","protected":false},"author":120,"featured_media":3652,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[6,227],"tags":[],"class_list":["post-208","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-dmarc","category-spf"],"_links":{"self":[{"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/posts\/208","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/users\/120"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/comments?post=208"}],"version-history":[{"count":10,"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/posts\/208\/revisions"}],"predecessor-version":[{"id":6132,"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/posts\/208\/revisions\/6132"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/media\/3652"}],"wp:attachment":[{"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/media?parent=208"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/categories?post=208"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/tags?post=208"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}