How to make my third-party vendors DMARC-compliant?

Enterprises and startups alike often prefer outsourcing their business and marketing emails. This involves third-party services which handle everything from list management to tracking events through to deliverability monitoring. But these third-party services also increase risk by opening up opportunities for malicious actors to impersonate brands via domain spoofing and deploying phishing attacks on unsuspecting receivers.

It has been reported that around one-third of all spam messages circulating on the internet contain business-related content. Businesses and organizations can fall victim to these messages if they fail to implement the appropriate safeguards, and the use of third-party vendors for sending email messages may be a significant contributing factor.

Integrating DMARC policies with all your third parties can help you prevent spoofing, phishing, and malware attacks that infiltrate your domain.

Why is it important to align your email sending sources?

Email is critical to the success of any business because it enables businesses to stay in contact with their customers and prospects. It is widely used as a primary means of communication and market research, and its importance will only increase as time progresses. Whatever email vendor you use to send your emails, be sure to check whether they support sending DMARC compliant emails on your behalf. 

DMARC is an email security protocol to help prevent phishing attacks, domain spoofing, and BEC. But to be truly effective, a company needs to work closely with all its third parties, so that all emails are DMARC compliant.

Making Your Third-party Vendors DMARC-Compliant

To establish an effective DMARC policy, you should contact your third-party providers to work together with you on the best way to handle email that fails validation. It can prove to be beneficial to explain the advantages of DMARC, answer questions about how it works, and recommend solutions that will help them to fully implement DMARC.

Each third party is different, with its own SPF and DKIM setup process that you’ll need to plan for. To determine the best strategy, you need to be aware of how each partner sends email marketing campaigns, in addition to their technical tracking abilities, reporting features, and integration capabilities. While the process might seem cumbersome and tedious, there are a few easy ways you can speed things up from your side:

  • You can set up a custom subdomain for each of your email vendors and let them handle SPF and DKIM authentication for that domain. In this case, the email vendor uses their mail server to send your emails. The vendor publishes their SPF and DKIM records in the DNS of your subdomain. If you don’t configure a separate DMARC policy for this consigned subdomain, the DMARC policy for your main domain gets automatically levied on your subdomain.
  • Alternatively, the third-party vendor can use your mail servers while sending emails to your clients from your domain. This by default ensures that if you have a DMARC policy for your domain in place, the outgoing emails would be automatically DMARC-compliant. Make sure you update your SPF and DKIM records to include the said third parties to ensure that they are enlisted as an authorized sending source. 

Setting Up SPF, DKIM, and DMARC records for your third-party vendors

  • Make sure you are updating your existing SPF record to include these email sending sources. For example, if you use MailChimp as an email vendor to send marketing emails on behalf of your organization, you need to update your existing SPF record or create a new record (in case you don’t have one in place) that includes MailChimp as an authorized sender. This can be done by either adding an include: mechanism or specific IP addresses used by the vendor while sending your emails.
  • Next, you would need to request your vendor to generate a DKIM key pair for your custom domain. They would use the private key to sign your emails while sending them, and the public key needs to be published by you on your public-facing DNS. The private key is matched against the public key in your DNS by your receivers, during verification.

You can read our email authentication knowledgebase articles to get easy-to-follow, step-by-step instructions on how to set up DMARC, SPF, and DKIM for various third-party vendors that you might be using. 

At PowerDMARC, we provide solutions for DMARC deployment and monitoring to help you ensure maximum DMARC compliance. We provide scalable DMARC monitoring solutions with the most in-depth capabilities on the market to help you manage your sending practices in coordination with your vendors’ sending practices. 

With our resources and expertise, we can take the guesswork out of DMARC compliance while delivering analytical reports that identify those that are and those that are not compliant. Sign up for your free DMARC trial today! 

Latest posts by Syuzanna Papazyan (see all)
/by