DMARC validation check
Prerequisites:
None
Package:
Mail.
Executed on:
All nameserver IP addresses.
Check interval:
Every 5 minutes.
Impact on Availability:
None.
Impact on Integrity:
None.
Purpose
DMARC stands for Domain-based Message Authentication, Reporting, and Conformance.
The DMARC record describes how an unauthenticated email should be handled and how it should be reported. An email message can be authenticated using either DKIM or SPF. Because the DMARC record is published in the DNS, it can be easily deciphered by any mail transfer agent.
This check ensures that the DMARC record has not changed since the last time domain monitoring was configured.
Event severities and messages
INFO
DMARC record match.
No detected changes to the DMARC TXT record.
WARNING
No DMARC record is configured for the zone.
Without a DMARC record the MTA’s cannot decipher what to do with unauthenticated emails.
ERROR
Expected: {DMARC string}, Received from query: {Response}.
The DMARC record string has changed since the zone was last configured for monitoring. If this is intentional, please update the domain configuration by selecting the Reconfigure option in the Domain tab to update the monitoring database.
No DMARC record found when it should be.
The DMARC record string has been removed since the zone was last configured for monitoring. If this was done intentionally, please update the domain configuration by selecting the Reconfigure option in the Domain tab to update the monitoring database.
UNKNOWN
Received RCODE from server.
Please see the Generic DNS response code page for further information.
Solutions, tips & tricks
It is easy to gently introduce a DMARC policy. The policy can be None, Quarantine or Deny, but the pct (percentage) option makes it easy to gradually increase the strength of the DMARC policy.