2021 has seen an increased adoption rate for email security solutions like DMARC, hence this DMARC checklist will touch base on various measures you can take to strengthen your security game. Implementing DMARC at your organization is undoubtedly a must-do in 2021, owing to the increased adoption of remote working environments ever since the onset of the COVID-19 pandemic, and the subsequent increase in email fraud and domain spoofing attempts. But simply publishing a DMARC TXT record in your DNS and configuring the protocol for your domain is just not enough! These are the steps you need to add to your DMARC checklist in 2021 to get the best out of your DMARC software solution!

Key Points to Add to Your DMARC Checklist

1. Gradually Shift to a Reject Policy

When you start off on your email authentication journey, a recommended policy mode of none will not only allow you to get accustomed to the newly implemented protocol, it will also help you monitor your email flow effectively. But the primary purpose of configuring DMARC is to protect your domain from spoofing, which a none policy doesn’t fulfill. Shifting to a DMARC enforcement policy of reject/quarantine can help you gain maximum protection against impersonation. Our DMARC analyzer helps you shift to an enforced policy smoothly, without your email deliverability rate suffering.

2. Enable DMARC Monitoring for Your Domain

In case you didn’t know, DMARC also presents domain owners with a reporting mechanism that allows them to receive information about authentication results and sending sources. Sent in an XML file format, these reports provide you with a wealth of information about every email being sent from your domain, the underlying IP addresses, hostnames, etc. However, to an untrained eye, reading XML reports can be difficult. PowerDMARC’s DMARC XML Reader makes DMARC reports human-readable and coherent with organized viewing formats, to filter reports by:

Sending sources
Hosts
Results
Reporting organizations
Country
Geolocations
Detailed statistics

3. Never Exceed the SPF Hard Limit

RFC for SPF has strict guidelines pertaining to the number of DNS lookups that are allowed per authentication check. So far a maximum of 10 lookups is allowed, exceeding which breaks SPF. Without any external help, staying under the limit is almost impossible considering the various third-party cloud services organizations have to use every day. This makes it a real hassle for domain owners. SPF flattening can help you stay under the limit and ensure email deliverability so that you have a seamless SPF authentication experience.

4. Improve Your Domain’s Security Rating

Your domain’s security depends on a lot of factors. You may have syntactical errors in your published authentication records, you may have configured your protocols with the wrong policy mode, or skipped out on certain protocol implementations completely.

All of these errors can contribute to your domain becoming more and more vulnerable to email fraud and domain abuse. Check your domain from time to time to improve upon your record configurations (for DMARC, SPF, DKIM, BIMI, MTA-STS, TLS-RPT) and resolve errors to get a robust email security posture at your organization.

About
Latest Posts

Ahona Rudra

Domain & Email Security Expert at PowerDMARC

Ahona is the Marketing Manager at PowerDMARC, with 5+ years of experience in writing about cybersecurity topics, specializing in domain and email security. Ahona holds a post-graduation degree in Journalism and Communications, solidifying her career in the security sector since 2019.

2021 DMARC Deployment Checklist

Key Points to Add to Your DMARC Checklist

1. Gradually Shift to a Reject Policy

2. Enable DMARC Monitoring for Your Domain

3. Never Exceed the SPF Hard Limit

4. Improve Your Domain’s Security Rating

Tools

Product

Company