31 July 2026 · DMARC Engine · 38 min read
Introduction to DMARC Alignment Challenges
DMARC alignment can be a complex and nuanced topic, particularly when automated email routing rules are involved. At DMARC Engine, we have seen numerous cases where organisations have struggled to maintain DMARC alignment due to the use of automated routing rules. For instance, a company may use Microsoft 365 to route emails from a specific domain to a third-party service for archiving or compliance purposes. If the routing rule is not properly configured, it can cause the email to fail DMARC alignment, leading to delivery issues.
One common issue we encounter is with organisations that use automated routing rules to forward emails to external addresses. For example, a company may have a routing rule that forwards all emails from a specific department to a shared mailbox. If the shared mailbox is hosted on a different domain, the email may fail DMARC alignment, as the From domain no longer matches the domain of the mail server that sent the email.
v=DMARC1; p=reject; pct=100; rua=mailto:aggregatereports@example.com; ruf=mailto:forensicreports@example.com; fo=1In this example, the DMARC record is set to reject emails that fail alignment, which can cause delivery issues if the automated routing rule is not properly configured.
Another challenge we see is with organisations that use multiple email service providers. For instance, a company may use Google Workspace for their primary email, but also use a third-party service for marketing or customer support emails. If the third-party service is not properly configured to use the same domain as the primary email service, it can cause DMARC alignment issues.
v=DMARC1; p=none; pct=100; rua=mailto:aggregatereports@example.com; ruf=mailto:forensicreports@example.com; adkim=r; aspf=rIn this example, the DMARC record is set to monitor emails for alignment issues, but not to reject them. This can be a good starting point for organisations that are trying to troubleshoot DMARC alignment issues.
In a hosted or managed setup, such as the one provided by DMARC Engine, we can help organisations to optimise their DMARC configuration and automate the process of maintaining DMARC alignment. Our system can analyse the aggregate reports and provide recommendations for improving DMARC alignment. We can also help organisations to configure their SPF and DKIM records to ensure that they are properly aligned with their DMARC policy.
However, even with a hosted or managed setup, there are still trade-offs and considerations that need to be taken into account. For instance, organisations may need to balance the need for strict DMARC alignment with the need for flexibility in their email routing rules. They may also need to consider the impact of DMARC alignment on their email deliverability and the potential for false positives or false negatives.
To centre on a specific example, we had a customer who was using automated routing rules to forward emails from their primary domain to a subdomain. The subdomain was hosted on a different mail server, which caused the emails to fail DMARC alignment. To resolve the issue, we worked with the customer to configure a new SPF record that included the IP address of the mail server hosting the subdomain. We also helped them to configure a new DKIM key that was specific to the subdomain.
default._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCq4j2zyN7x+U5P9EJ4+Uj6T9kTQ4m6tj4qj2zyN7x+U5P9EJ4+Uj6T9kTQ4m6tj4qj2zyN7x+U5P9EJ4+Uj6T9k"By making these changes, the customer was able to maintain DMARC alignment and ensure that their emails were delivered to the inbox.
In short, DMARC alignment can be a complex issue, particularly when automated email routing rules are involved. Organisations need to carefully consider their DMARC configuration and ensure that it is properly aligned with their email routing rules. By working with a hosted or managed setup, such as the one provided by DMARC Engine, organisations can optimise their DMARC configuration and automate the process of maintaining DMARC alignment. However, there are still trade-offs and considerations that need to be taken into account, and organisations need to be aware of the potential impact on their email deliverability.
Automated Email Routing Rules in Microsoft 365
Microsoft 365, formerly known as Office 365, is a popular choice for organisations to manage their email services. One of its features is automated email routing rules, which can be configured to redirect emails to specific mailboxes or external email addresses based on certain conditions. However, these rules can sometimes cause issues with DMARC alignment, particularly when it comes to SPF and DKIM authentication.
When an email is routed through Microsoft 365, it can be forwarded to an external email address, which may not be aligned with the original domain. For example, let's say a company called Example Ltd has a domain example.com and uses Microsoft 365 for their email services. They have set up an automated email routing rule to forward all emails from their sales team to an external email address, sales@example.net. If an email is sent from a sales team member to a customer, and the customer's email provider checks the DMARC record for example.com, it may fail the SPF check because the email was forwarded from example.net, which is not aligned with the original domain.
To mitigate this issue, organisations can use a technique called "SPF flattening" in their Microsoft 365 setup. This involves adding the IP addresses of the external email service to the SPF record of the original domain. For instance, if Example Ltd uses Mailchimp to send marketing emails, they can add Mailchimp's IP addresses to their SPF record to ensure that emails sent through Mailchimp are authenticated correctly.
example.com. IN TXT "v=spf1 include:mailchimp.com ~all"In this example, the SPF record for example.com includes Mailchimp's IP addresses, allowing emails sent through Mailchimp to pass the SPF check.
Another challenge with automated email routing rules in Microsoft 365 is the use of transport rules. Transport rules can be used to redirect emails to specific mailboxes or external email addresses based on certain conditions, such as the sender's email address or the email's subject. However, these rules can sometimes cause issues with DKIM authentication. When an email is redirected using a transport rule, the DKIM signature may not be updated correctly, causing the email to fail the DKIM check.
To resolve this issue, organisations can use a feature in Microsoft 365 called "DKIM signing" for their custom domains. This involves generating a DKIM key pair and adding the public key to the DNS records for the domain. Microsoft 365 will then use the private key to sign emails sent from the domain, ensuring that the DKIM signature is updated correctly when emails are redirected using transport rules.
default._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+yt4uH7M6sKjHbsmR9vZmWIb1k1jHnQYz1d+9nGjD9fTYsUz1TzmmxMz8p4wKMVwVgk1Yt1xWZGfb9jR1p2xjGjN1xJjHnQYz1d+9nGjD9fTYsUz1TzmmxM"In this example, the DKIM public key is added to the DNS records for example.com, allowing Microsoft 365 to sign emails sent from the domain using the private key.
In a hosted or managed setup, such as DMARC Engine, the centre of expertise is on handling these complexities to optimise email deliverability. For instance, DMARC Engine can help organisations configure their SPF and DKIM records correctly, taking into account automated email routing rules and transport rules in Microsoft 365. They can also provide guidance on how to use SPF flattening and DKIM signing to ensure that emails are authenticated correctly and aligned with the original domain.
When configuring automated email routing rules in Microsoft 365, it is essential to consider the impact on DMARC alignment. Organisations should ensure that their SPF and DKIM records are configured correctly to account for any email forwarding or redirection. They should also use features such as SPF flattening and DKIM signing to optimise email deliverability and prevent issues with DMARC alignment.
In real-world scenarios, organisations may need to use a combination of these techniques to achieve optimal DMARC alignment. For example, an organisation may use automated email routing rules to forward emails to an external email address, while also using SPF flattening and DKIM signing to ensure that emails are authenticated correctly. By taking a holistic approach to email deliverability and considering the complexities of automated email routing rules, organisations can improve their DMARC alignment and reduce the risk of email deliverability issues.
To colour outside the lines, organisations can also use third-party services to help manage their DMARC alignment and email deliverability. These services can provide additional features and expertise to help organisations optimise their email setup and improve their deliverability rates. For instance, DMARC Engine can provide organisations with detailed analytics and insights into their email deliverability, helping them to identify areas for improvement and optimise their email setup accordingly.
In short, automated email routing rules in Microsoft 365 can cause issues with DMARC alignment, particularly when it comes to SPF and DKIM authentication. However, by using techniques such as SPF flattening and DKIM signing, organisations can mitigate these issues and improve their email deliverability. It is crucial to consider the impact of automated email routing rules on DMARC alignment and to configure SPF and DKIM records correctly to account for any email forwarding or redirection. By taking a proactive approach to email deliverability and considering the complexities of automated email routing rules, organisations can improve their DMARC alignment and reduce the risk of email deliverability issues.
Google Workspace Email Routing and DMARC Alignment
Google Workspace, formerly known as G Suite, offers a robust email routing system that allows organisations to automate the flow of emails based on specific criteria, such as sender, recipient, or content. However, when implementing DMARC, organisations may encounter alignment challenges due to the way Google Workspace routes emails. In this section, we will delve into the specifics of Google Workspace email routing and its impact on DMARC alignment, highlighting trade-offs, and providing concrete recommendations for optimising DMARC setup.
When emails are routed through Google Workspace, the email headers are modified, which can affect DMARC alignment. For instance, if an email is forwarded from a user's Gmail account to an external address using a routing rule, the From header may be rewritten, causing DMARC alignment issues. To illustrate this, consider a scenario where a company, Example Ltd, has a Google Workspace account, and they have set up a routing rule to forward all emails from sales@example.com to sales-external@example.com. The original email may have a From header with the domain example.com, but after routing, the From header may be changed to sales-external@example.com, which can cause DMARC alignment issues if the DMARC record is set up to expect emails from example.com.
To mitigate this issue, organisations can use the relaxed alignment mode in their DMARC record, which allows for a more flexible alignment of the From header with the domain in the DMARC record. For example, the DMARC record for example.com might include the following snippet:
_dmarc.example.com. IN TXT "v=DMARC1; p=none; sp=none; adkim=r; aspf=r; pct=100; rf=afrf; ri=86400"In this example, the adkim=r and aspf=r parameters specify relaxed alignment for both DKIM and SPF, allowing for a greater degree of flexibility in email routing scenarios.
Another challenge with Google Workspace email routing is the use of automated email routing rules that can modify email headers, such as adding or removing headers, or changing the email content. These modifications can affect DMARC alignment, particularly if the modifications are made after the email has been signed with DKIM or authenticated with SPF. To centre the DMARC alignment setup around these automated routing rules, organisations can use a combination of SPF and DKIM records that account for the modifications made by the routing rules.
For instance, organisations can set up a separate SPF record for the external domain used in the routing rule, such as sales-external@example.com. This SPF record can include the IP addresses of the Google Workspace servers, as well as any other servers that may be used to send emails on behalf of the organisation. Here is an example of what the SPF record might look like:
sales-external.example.com. IN TXT "v=spf1 include:_spf.google.com ip4:216.58.194.174 ip4:216.58.194.174 -all"In this example, the SPF record includes the Google Workspace servers, as well as a specific IP address that is used to send emails on behalf of the organisation.
In addition to SPF records, organisations can also use DKIM signing to authenticate emails sent through Google Workspace. Google Workspace provides a built-in DKIM signing feature that can be enabled for each domain, allowing organisations to sign emails with a DKIM key. To optimise DKIM signing for automated email routing scenarios, organisations can use a separate DKIM key for each external domain used in the routing rule. For example, the DKIM record for sales-external@example.com might look like this:
default._domainkey.sales-external.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4hxBHe4pdZxP3G4hZj4cPz+K3dNk7U5mH0l5yqzZp2Uwc6C0WmZ9W03d4phdK+VX1X7wP3x/7dJiQ5V6m0UQunrM4T1sV6m0UQunrM4T1sV6m0U"In this example, the DKIM record includes a separate DKIM key for the sales-external@example.com domain, which can be used to sign emails sent through the automated routing rule.
To colour the DMARC alignment setup with real-world examples, consider a scenario where Example Ltd has a Google Workspace account and uses automated email routing rules to forward emails from sales@example.com to sales-external@example.com. To maintain DMARC alignment, Example Ltd sets up a separate SPF record for the sales-external@example.com domain, as well as a separate DKIM key for signing emails sent through the routing rule. The DMARC record for example.com includes relaxed alignment parameters, allowing for flexibility in email routing scenarios.
In a hosted or managed setup, such as the one provided by DMARC Engine, organisations can benefit from automated DMARC setup and management, including the configuration of SPF and DKIM records for automated email routing scenarios. The hosted setup can also provide real-time monitoring and analysis of DMARC reports, allowing organisations to quickly identify and resolve DMARC alignment issues. By optimising the DMARC setup for automated email routing scenarios, organisations can improve email deliverability and reduce the risk of email spoofing and phishing attacks.
In short, Google Workspace email routing can pose challenges for DMARC alignment, particularly when automated routing rules modify email headers or content. To mitigate these challenges, organisations can use relaxed alignment modes, separate SPF and DKIM records for external domains, and optimise DKIM signing for automated email routing scenarios. By centreing the DMARC alignment setup around these automated routing rules and using a combination of SPF and DKIM records, organisations can maintain DMARC alignment and improve email deliverability.
Understanding DMARC Alignment Modes
DMARC alignment is a critical aspect of email authentication, and understanding the different modes is essential to optimise your email deliverability. In a hosted or managed setup, such as the one we operate at DMARC Engine, we often see customers struggling with alignment issues due to automated email routing rules. To centre our discussion, let us consider a real-world example. Suppose we have a customer, example.com, with a DMARC record that specifies a policy of p=none and alignment mode aspf=r and adkim=r. Their DMARC record might look like this:
_dmarc.example.com. IN TXT "v=DMARC1; p=none; aspf=r; adkim=r; fo=1"In this example, the aspf=r and adkim=r parameters specify that the domain owner wants to apply relaxed alignment mode for both SPF and DKIM. This means that the domain owner wants to allow subdomains to send email on their behalf, and the SPF and DKIM checks should pass if the domain or subdomain matches the From domain.
However, when automated email routing rules are introduced, things can get complicated. For instance, if example.com has a routing rule that forwards emails from a subdomain, say subdomain.example.com, to a third-party service, the SPF check may fail if the third-party service does not include the subdomain in its SPF record. In a hosted setup, we can help customers identify such issues by analysing their aggregate reports. We have seen cases where customers have set up automated routing rules without considering the impact on DMARC alignment, resulting in a significant number of emails being flagged as unauthenticated.
To mitigate this issue, it is essential to understand the trade-offs between relaxed and strict alignment modes. Relaxed alignment mode, as specified by aspf=r and adkim=r, allows for a more flexible authentication mechanism, which can be beneficial for domains with complex email infrastructures. However, it also increases the risk of spoofing attacks, as an attacker could potentially send email from a subdomain that is not explicitly listed in the SPF or DKIM records. On the other hand, strict alignment mode, specified by aspf=s and adkim=s, provides a more secure authentication mechanism but can be more challenging to implement, especially for domains with automated email routing rules.
In our experience, most customers opt for relaxed alignment mode, as it provides a more straightforward implementation path. However, we recommend that customers carefully evaluate their email infrastructure and consider the potential risks and benefits of each alignment mode. For example, if a customer has a simple email infrastructure with no automated routing rules, strict alignment mode may be a better choice. In contrast, if a customer has a complex email infrastructure with multiple automated routing rules, relaxed alignment mode may be more suitable.
To illustrate the difference between relaxed and strict alignment modes, let us consider another example. Suppose we have a customer, example.net, with a DMARC record that specifies a policy of p=none and alignment mode aspf=s and adkim=s. Their DMARC record might look like this:
_dmarc.example.net. IN TXT "v=DMARC1; p=none; aspf=s; adkim=s; fo=1"In this example, the aspf=s and adkim=s parameters specify that the domain owner wants to apply strict alignment mode for both SPF and DKIM. This means that the domain owner wants to ensure that only the exact domain or subdomain specified in the From header can send email on their behalf. If example.net has an automated email routing rule that forwards emails from a subdomain, say subdomain.example.net, to a third-party service, the SPF and DKIM checks will fail if the third-party service does not exactly match the subdomain.
In a hosted or managed setup, we can help customers navigate these complexities by providing detailed analysis of their aggregate reports and recommending the optimal alignment mode for their specific use case. By understanding the trade-offs between relaxed and strict alignment modes, customers can make informed decisions about their email authentication strategy and optimise their email deliverability. Ultimately, the choice of alignment mode depends on the customer's specific email infrastructure and security requirements. As such, it is crucial to carefully evaluate the potential risks and benefits of each alignment mode and consider the impact of automated email routing rules on DMARC alignment.
Practical Solutions for Maintaining DMARC Alignment
Maintaining DMARC alignment in the presence of automated email routing rules can be a complex task, requiring careful consideration of the trade-offs between email deliverability, security, and ease of use. One practical solution is to use a third-party email service provider that can handle DMARC alignment on behalf of the organisation, such as DMARC Engine. These providers can optimise DMARC records, including SPF and DKIM, to ensure alignment with automated routing rules. For example, when using Microsoft 365, the hosted setup can automatically configure SPF records to include the Microsoft 365 mail servers, thus maintaining DMARC alignment.
When using automated routing rules, it is essential to ensure that the routing rules do not modify the email headers in a way that breaks DMARC alignment. For instance, if a routing rule adds a new From header, it can cause the DMARC alignment to fail. To avoid this, organisations can use routing rules that modify the email headers in a way that preserves the original From header. The following example shows a routing rule in Microsoft 365 that adds a new From header, which can break DMARC alignment:
// Microsoft 365 routing rule example
{
"Name": "Add new From header",
"RuleType": "ModifyMessage",
"Conditions": {
"Sender": {
"EmailAddress": {
"Address": "user@example.com",
"ExcludeSubdomains": false
}
}
},
"Actions": {
"ModifyMessage": {
"AddHeader": {
"Name": "From",
"Value": "new-from-header@example.com"
}
}
}
}To maintain DMARC alignment, organisations can modify the routing rule to preserve the original From header, as shown in the following example:
// Modified Microsoft 365 routing rule example
{
"Name": "Preserve original From header",
"RuleType": "ModifyMessage",
"Conditions": {
"Sender": {
"EmailAddress": {
"Address": "user@example.com",
"ExcludeSubdomains": false
}
}
},
"Actions": {
"ModifyMessage": {
"AddHeader": {
"Name": "X-Original-From",
"Value": "${OriginalFromHeader}"
}
}
}
}In this modified example, the routing rule adds a new X-Original-From header that preserves the original From header, thus maintaining DMARC alignment.
Another practical solution is to use a DMARC alignment mode that is more relaxed, such as relaxed mode, which allows for a greater degree of flexibility in the email headers. However, this mode also increases the risk of spam and phishing attacks, as it allows more flexibility in the email headers. The following example shows a DMARC record in relaxed mode:
// DMARC record example in relaxed mode
_dmarc.example.com. IN TXT "v=DMARC1; p=none; sp=none; adkim=r; aspf=r; fo=1"In this example, the DMARC record is set to relaxed mode, which allows for a greater degree of flexibility in the email headers. However, organisations should carefully consider the trade-offs between email deliverability and security before using relaxed mode.
In addition to using a hosted setup or modifying routing rules, organisations can also use DKIM signing to maintain DMARC alignment. DKIM signing involves adding a digital signature to the email headers, which can help to verify the authenticity of the email. The following example shows a DKIM record:
// DKIM record example
default._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCqGKukO1De7zhZj6+H0qtjTkVxwTCpvKe4eCZ0FPqri0cb2JZfXJ/DgYSF6vUpwmJG8wVQZKjeGcjDOL5UlsuusFncCzWBQ7RKNUSesmQRMSGkVb1/3j+skZ6UtW+5u09lHNsj6tQ51s1SPrCBkedbNf0Tp0GbMJDyR4e9T04ZZwIDAQAB"In this example, the DKIM record is used to add a digital signature to the email headers, which can help to verify the authenticity of the email and maintain DMARC alignment.
In a managed setup, such as DMARC Engine, the organisation can outsource the management of DMARC records, including SPF and DKIM, to the provider. This can help to simplify the process of maintaining DMARC alignment and reduce the risk of errors. The provider can also provide additional features, such as automated reporting and analysis, to help organisations to optimise their DMARC setup.
To optimise the DMARC setup, organisations can use aggregate reporting to monitor DMARC alignment issues. Aggregate reporting involves collecting data on DMARC alignment issues and providing insights into the causes of the issues. The following example shows an aggregate report:
// Aggregate report example
{
"reportMetadata": {
"orgName": "example.com",
"email": "dmarc@example.com",
"extraContacts": [],
"reportId": "1234567890",
"dateRange": {
"begin": "2022-01-01",
"end": "2022-01-31"
}
},
"policyPublished": {
"domain": "example.com",
"adkim": "r",
"aspf": "r",
"p": "none",
"sp": "none",
"pct": 100
},
"summary": {
"totalRecords": 1000,
"totalMessages": 10000,
"passDmarc": 9000,
"failDmarc": 1000
},
"records": [
{
"row": {
"sourceIp": "192.0.2.1",
"count": 100,
"disposition": "none",
"dkim": "pass",
"spf": "pass"
}
},
{
"row": {
"sourceIp": "198.51.100.1",
"count": 50,
"disposition": "quarantine",
"dkim": "fail",
"spf": "fail"
}
}
]
}In this example, the aggregate report provides insights into DMARC alignment issues, including the number of records that passed or failed DMARC alignment. Organisations can use this data to optimise their DMARC setup and reduce the risk of errors.
In conclusion to this section, maintaining DMARC alignment in the presence of automated email routing rules requires careful consideration of the trade-offs between email deliverability, security, and ease of use. Organisations can use practical solutions, such as hosted setups, modified routing rules, and DKIM signing, to maintain DMARC alignment. Also, organisations can use aggregate reporting to monitor DMARC alignment issues and optimise their DMARC setup. By using these solutions, organisations can reduce the risk of errors and improve the overall security and deliverability of their email communications.
Aggregate Report Analysis for DMARC Alignment Issues
When analysing aggregate reports for DMARC alignment issues, it is crucial to understand the colour of the report data, which can centre around the organisation's domain alignment with SPF and DKIM records. Our team at DMARC Engine reviews these reports daily for our customers, and we have seen a multitude of issues that can cause misalignment. For instance, automated email routing rules can often lead to issues with DMARC alignment, particularly if the routing rules are not properly configured to maintain alignment.
To begin with, it is essential to optimise the DMARC record to receive detailed aggregate reports. This involves setting the aggregate report interval to a suitable time frame, such as daily or weekly, depending on the organisation's email volume. The report will contain data on the source IP addresses of emails that claim to originate from the organisation's domain, along with the corresponding SPF and DKIM results.
{
"org_name": "example.com",
"email": "reports@example.com",
"extra_contact_info": "https://example.com/dmarc",
"report_id": "11111111-1111-1111-1111-111111111111",
"date_range": {
"begin": "2022-01-01T00:00:00Z",
"end": "2022-01-01T23:59:59Z"
},
"policy_published": {
"domain": "example.com",
"adkim": "r",
"aspf": "r",
"p": "none",
"sp": "none",
"pct": 100
},
"records": [
{
"row": {
"source_ip": "192.0.2.1",
"count": 10,
"policy_evaluated": {
"disposition": "none",
"dkim": "pass",
"spf": "fail"
}
}
}
]
}In the above example, the report indicates that there were 10 emails from the source IP address 192.0.2.1 that had a DKIM pass result but an SPF fail result. This suggests that the email was signed with a valid DKIM key, but the SPF check failed, which could be due to the email being routed through a mail server that is not included in the organisation's SPF record.
Our experience with hosted DMARC setups has shown that automated email routing rules can be a common cause of DMARC alignment issues. For instance, if an organisation has a mail routing rule that forwards emails from a specific department to an external email address, this can cause the email to be routed through a different mail server, which may not be included in the organisation's SPF record. To mitigate this issue, it is essential to ensure that all mail servers involved in the routing process are included in the SPF record.
In addition to SPF issues, DKIM alignment can also be a challenge, particularly if the organisation is using a third-party email service provider. In such cases, it is crucial to ensure that the email service provider is signing emails with a valid DKIM key that is aligned with the organisation's domain. We have seen cases where the email service provider is using a default DKIM key that is not aligned with the organisation's domain, which can cause DMARC alignment issues.
To resolve DKIM alignment issues, it is essential to work with the email service provider to ensure that they are using a valid DKIM key that is aligned with the organisation's domain. This may involve generating a new DKIM key and updating the DNS records to include the new key. Our team at DMARC Engine has experience with configuring DKIM records for hosted email service providers and can provide guidance on how to resolve DKIM alignment issues.
In terms of practical recommendations, we advise organisations to regularly review their aggregate reports to identify potential DMARC alignment issues. This involves monitoring the reports for any emails that have a DKIM or SPF fail result, and investigating the cause of the failure. It is also essential to ensure that all mail servers involved in the email routing process are included in the SPF record, and that the email service provider is using a valid DKIM key that is aligned with the organisation's domain.
Also, organisations should consider implementing a DMARC policy that is aligned with their email routing rules. For instance, if an organisation has a mail routing rule that forwards emails from a specific department to an external email address, they should ensure that the DMARC policy is configured to allow for this routing. This may involve setting the DMARC policy to none or quarantine to allow for emails to be delivered even if they fail the DMARC check.
In conclusion to this section, aggregate report analysis is a crucial step in identifying and resolving DMARC alignment issues. By regularly reviewing the reports and investigating the cause of any failures, organisations can ensure that their DMARC policy is effective in preventing email spoofing and phishing attacks. Our team at DMARC Engine is experienced in analysing aggregate reports and providing guidance on how to resolve DMARC alignment issues, and we recommend that organisations work with a hosted DMARC provider to ensure that their DMARC policy is properly configured and aligned with their email routing rules.
It is also worth considering the impact of automated email routing rules on the organisation's email deliverability. If the routing rules are not properly configured, it can lead to emails being blocked or rejected by recipient mail servers, which can have a significant impact on the organisation's email deliverability. Therefore, it is essential to ensure that the email routing rules are properly configured and aligned with the DMARC policy to ensure that emails are delivered successfully.
In our experience, the key to successful DMARC alignment is to ensure that all stakeholders are aware of the potential issues and are working together to resolve them. This includes the email administrators, the security team, and the email service providers. By working together, organisations can ensure that their DMARC policy is effective in preventing email spoofing and phishing attacks, and that their email deliverability is optimised.
To optimise the DMARC setup, it is essential to consider the trade-offs between the different components of the setup. For instance, the organisation may need to balance the need for a strict DMARC policy with the need for email deliverability. A strict DMARC policy may block legitimate emails, while a lenient policy may allow spam emails to be delivered. Therefore, it is essential to carefully consider the trade-offs and configure the DMARC setup accordingly.
In terms of specific recommendations, we advise organisations to start with a lenient DMARC policy and gradually increase the strictness of the policy as they become more comfortable with the setup. This involves monitoring the aggregate reports and adjusting the policy as needed to ensure that legitimate emails are not blocked. It is also essential to ensure that all mail servers involved in the email routing process are included in the SPF record, and that the email service provider is using a valid DKIM key that is aligned with the organisation's domain.
By following these recommendations and carefully considering the trade-offs, organisations can ensure that their DMARC setup is optimised and effective in preventing email spoofing and phishing attacks. Our team at DMARC Engine is experienced in configuring DMARC setups and providing guidance on how to optimise the setup for email deliverability and security.
The colour of the report data can also provide valuable insights into the organisation's email routing rules and DMARC setup. For instance, if the report data shows a high volume of emails with a DKIM or SPF fail result, it may indicate that the email routing rules are not properly configured or that the DMARC setup is not effective. Therefore, it is essential to regularly review the report data and investigate the cause of any failures to ensure that the DMARC setup is optimised and effective.
In addition to the report data, it is also essential to consider the impact of automated email routing rules on the organisation's email deliverability. If the routing rules are not properly configured, it can lead to emails being blocked or rejected by recipient mail servers, which can have a significant impact on the organisation's email deliverability. Therefore, it is essential to ensure that the email routing rules are properly configured and aligned with the DMARC policy to ensure that emails are delivered successfully.
To centre the DM
Configuring SPF and DKIM Records for Automated Routing
When implementing automated email routing rules, configuring SPF and DKIM records correctly is crucial to maintain DMARC alignment. This is because routing rules can alter the sender's IP address or modify the email content, which in turn can cause SPF or DKIM validation failures. For instance, in a Microsoft 365 setup, automated routing rules can be configured to redirect emails to a third-party service for archiving or compliance purposes. In such cases, the email is forwarded from the Microsoft 365 servers to the third-party service, which can lead to SPF failures if the third-party service's IP address is not included in the SPF record.
To mitigate this issue, it is essential to include the IP addresses of all servers that may forward emails on behalf of the domain in the SPF record. This can be achieved by adding the IP addresses of the third-party services or the automated routing rules to the SPF record. For example, if a domain uses a third-party archiving service with the IP address 192.0.2.1, the SPF record should include this IP address:
TXT "v=spf1 include:_spf.example.com ip4:192.0.2.1 -all"In a hosted or managed setup, such as DMARC Engine, the process of configuring SPF records is simplified through a user-friendly interface. The system provides a centralised dashboard to manage SPF records, making it easier to add or remove IP addresses as needed.
DKIM records also require careful configuration when automated routing rules are in place. DKIM signatures are generated based on the email content and the selector record. If the email content is modified during the routing process, the DKIM signature may become invalid. To avoid this issue, it is recommended to use a DKIM signature that is generated after the email has been routed. This can be achieved by configuring the DKIM signing process to occur at the final hop before the email is delivered to the recipient.
For example, if a domain uses a third-party service to route emails, the DKIM signature can be generated by the third-party service using a selector record that is specific to that service:
TXT "k1._domainkey.example.com. 14400 IN TXT \"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCqGKukO1De7zhZj6+H0qtjTkVxwTCpvKe4eCZ0FPqri0cb2JZfXJ/DgYSF6vUpwmJG8wVQZKjeGcjDOL5UlsuusFncCzWBQ7RKNUSesmQRMSGkVb1/3j+skZ6UtW+5u09lHNsj6tQ51s1SPrCBkedbNf0Tp0GbMJDyR4e9T04ZZwIDAQAB\""In this example, the selector record k1._domainkey.example.com is specific to the third-party service, and the DKIM signature is generated using this selector record. This ensures that the DKIM signature remains valid even if the email content is modified during the routing process.
When configuring DKIM records, it is also essential to consider the canonicalization mode. The canonicalization mode determines how the email content is processed before generating the DKIM signature. There are two canonicalization modes: simple and relaxed. The simple mode is more restrictive and may cause DKIM validation failures if the email content is modified during the routing process. The relaxed mode is more flexible and allows for minor modifications to the email content without causing DKIM validation failures.
In general, it is recommended to use the relaxed canonicalization mode when automated routing rules are in place. This can be achieved by adding the c=relaxed parameter to the DKIM selector record:
TXT "k1._domainkey.example.com. 14400 IN TXT \"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCqGKukO1De7zhZj6+H0qtjTkVxwTCpvKe4eCZ0FPqri0cb2JZfXJ/DgYSF6vUpwmJG8wVQZKjeGcjDOL5UlsuusFncCzWBQ7RKNUSesmQRMSGkVb1/3j+skZ6UtW+5u09lHNsj6tQ51s1SPrCBkedbNf0Tp0GbMJDyR4e9T04ZZwIDAQAB\" c=relaxed"In a hosted or managed setup, such as DMARC Engine, the process of configuring DKIM records is simplified through a user-friendly interface. The system provides a centralised dashboard to manage DKIM records, making it easier to add or remove selector records as needed. Also, the system provides guidance on configuring the canonicalization mode and other DKIM settings to ensure optimal performance.
In short, configuring SPF and DKIM records for automated routing requires careful consideration of the email routing process and the potential impact on DMARC alignment. By including the IP addresses of all servers that may forward emails on behalf of the domain in the SPF record, and by using a DKIM signature that is generated after the email has been routed, organisations can maintain DMARC alignment and prevent email delivery issues. The use of a hosted or managed setup, such as DMARC Engine, can simplify the process of configuring SPF and DKIM records, and provide additional guidance and support to ensure optimal performance.
Trade-offs and Considerations for DMARC Alignment
When implementing DMARC alignment, organisations must carefully weigh the trade-offs between security, deliverability, and complexity. A key consideration is the choice between relaxed and strict alignment modes. Relaxed alignment, also known as domain alignment, checks if the domain in the From header matches the domain in the SPF or DKIM record, whereas strict alignment checks if the entire domain, including subdomains, matches exactly.
For example, a message with a From header of user@subdomain.example.com would pass relaxed alignment if the SPF or DKIM record is for example.com, but would fail strict alignment.
In a hosted setup, such as the one we manage at DMARC Engine, we often see customers opting for relaxed alignment to avoid issues with automated email routing rules, which may rewrite the From header to include a subdomain.
# Example of a DMARC record with relaxed alignment
_dmarc.example.com. IN TXT "v=DMARC1; p=none; sp=none; adkim=r; aspf=r"However, this approach may compromise security, as it allows for more flexibility in the From header domain. On the other hand, strict alignment provides stronger security guarantees, but may lead to deliverability issues if not implemented carefully.
In our experience, organisations with complex email infrastructures, such as those using automated email routing rules, may need to opt for relaxed alignment to avoid false positives.
For instance, a company using Microsoft 365 may have automated rules that forward emails from a subdomain to a central mailbox, which would fail strict alignment.
Another important consideration is the impact of DMARC alignment on mailing lists and email forwarding services. These services often rewrite the From header, which can cause DMARC alignment issues.
To mitigate this, organisations can use the percent tag in their DMARC record to specify a percentage of messages that should be subject to DMARC checks.
For example:
# Example of a DMARC record with percentage tag
_dmarc.example.com. IN TXT "v=DMARC1; p=none; sp=none; adkim=r; aspf=r; pct=20"This would apply DMARC checks to 20% of incoming messages, allowing organisations to test and refine their DMARC configuration without affecting all email traffic.
In addition to alignment modes and percentage tags, organisations must also consider the interplay between DMARC, SPF, and DKIM records.
For instance, if an organisation has a strict DMARC policy, but a relaxed SPF record, they may still be vulnerable to spoofing attacks.
To optimise their email security posture, organisations should ensure that their SPF and DKIM records are aligned with their DMARC policy.
In a managed setup, such as ours, we often see customers benefiting from a centralised management approach, which allows for easier configuration and monitoring of DMARC, SPF, and DKIM records.
When it comes to automated email routing rules, organisations must carefully consider the colour of the email traffic, as certain rules may inadvertently trigger DMARC alignment issues.
For example, a rule that forwards emails from a subdomain to a central mailbox may cause the From header to be rewritten, leading to DMARC alignment failures.
To centre their email security strategy around DMARC alignment, organisations should conduct a thorough review of their automated email routing rules and adjust them accordingly.
In our experience, a hosted setup can provide organisations with the necessary tools and expertise to navigate these complexities and optimise their DMARC alignment.
Ultimately, the key to successful DMARC alignment is a deep understanding of the organisation's email infrastructure and security posture.
By carefully weighing the trade-offs between security, deliverability, and complexity, organisations can implement a DMARC alignment strategy that meets their unique needs and optimises their email security.
In our work at DMARC Engine, we have seen firsthand the importance of a managed approach to DMARC alignment, which allows organisations to benefit from expert guidance and centralised management of their email security configuration.
By taking a holistic approach to email security and carefully considering the trade-offs and considerations for DMARC alignment, organisations can protect their brand and customers from email-based threats.
Real-World Examples and Case Studies of DMARC Alignment
In our experience of managing DMARC for numerous customers, alignment issues often arise from automated email routing rules, which can be tricky to optimise. For instance, a company like Example Ltd, which uses Microsoft 365, may set up a rule to forward emails from a specific sender to a shared mailbox. This can cause DMARC alignment problems if the forwarded email's SPF and DKIM signatures are not updated to reflect the new sender's domain.
To illustrate this, let's consider an example where Example Ltd has a DMARC record with a policy set to quarantine and an alignment mode of relaxed. Their DMARC record might look like this:
_dmarc.example.co.uk. IN TXT "v=DMARC1; p=quarantine; pct=100; rua=mailto:aggregate@example.co.uk; ruf=mailto:forensic@example.co.uk; fo=1"In this case, if an email is forwarded from a sender with a domain that does not match the alignment mode, it may fail DMARC validation. We have seen this happen with our customers who use automated email routing rules to forward emails to external addresses or shared mailboxes.
Another common issue we encounter is with companies that use Google Workspace. Google Workspace's email routing rules can cause DMARC alignment problems if not configured correctly. For example, if a company sets up a rule to forward emails from a specific sender to a Gmail address, the forwarded email's SPF and DKIM signatures may not be updated, causing DMARC validation to fail.
To mitigate this, we recommend configuring SPF and DKIM records to include the IP addresses and domains used by the automated email routing rules. This can be done by adding the IP addresses of the email routing servers to the SPF record, like so:
example.co.uk. IN TXT "v=spf1 include:_spf.google.com ip4:192.0.2.1 ip4:192.0.2.2 -all"And by configuring DKIM keys for the domains used by the automated email routing rules, like so:
default._domainkey.example.co.uk. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+ycg5L3vMMr3dPvKD4qYy6kKfjW0xj5k2vKu8K5x6KfjW0xj5k2vK"We have also seen issues with DMARC alignment when companies use third-party email services, such as Mailchimp or Marketo, to send emails on their behalf. These services often use their own domains and IP addresses to send emails, which can cause DMARC alignment problems if not configured correctly.
To resolve this, we recommend configuring DMARC records to include the third-party email services' domains and IP addresses. This can be done by adding the third-party email services' domains to the DMARC record's aspf and adkim tags, like so:
_dmarc.example.co.uk. IN TXT "v=DMARC1; p=quarantine; pct=100; rua=mailto:aggregate@example.co.uk; ruf=mailto:forensic@example.co.uk; fo=1; aspf=r; adkim=r"And by configuring SPF and DKIM records to include the third-party email services' IP addresses and domains, like so:
example.co.uk. IN TXT "v=spf1 include:_spf.mailchimp.com ip4:192.0.2.1 ip4:192.0.2.2 -all"In a hosted or managed setup, such as the one we provide at DMARC Engine, these issues can be mitigated by configuring the DMARC records and automated email routing rules to work together seamlessly. Our system allows customers to configure their DMARC records and automated email routing rules in a way that optimises DMARC alignment and minimises the risk of emails being blocked or quarantined.
For example, our system can be configured to update the SPF and DKIM signatures of forwarded emails to reflect the new sender's domain, ensuring that DMARC validation is successful. We can also configure our system to include the IP addresses and domains used by automated email routing rules in the SPF and DKIM records, ensuring that emails sent via these rules are authenticated correctly.
In addition, our system provides detailed aggregate reports that allow customers to monitor their DMARC alignment and identify any issues that may arise. These reports provide valuable insights into the effectiveness of the DMARC configuration and help customers to optimise their setup to achieve the best possible results.
To give you a better idea of what these reports look like, here is an example of an aggregate report snippet:
<feedback>
<version>1</version>
<report_metadata>
<org_name>example.co.uk</org_name>
<email>aggregate@example.co.uk</email>
<extra_contact_info>https://example.co.uk</extra_contact_info>
<report_id>1234567890</report_id>
<date_range>
<begin>2022-01-01T00:00:00Z</begin>
<end>2022-01-07T23:59:59Z</end>
</date_range>
</report_metadata>
<policy_published>
<domain>example.co.uk</domain>
<adkim>r</adkim>
<aspf>r</aspf>
<p>quarantine</p>
<sp>quarantine</sp>
<pct>100</pct>
</policy_published>
<record>
<row>
<source_ip>192.0.2.1</source_ip>
<count>10</count>
<disposition>none</disposition>
<dkim>pass</dkim>
<spf>pass</spf>
</row>
<row>
<source_ip>192.0.2.2</source_ip>
<count>5</count>
<disposition>quarantine</disposition>
<dkim>fail</dkim>
<spf>fail</spf>
</row>
</record>
</feedback>These reports can be used to identify issues with DMARC alignment and to optimise the DMARC configuration to achieve the best possible results. By analysing these reports, customers can gain valuable insights into the effectiveness of their DMARC setup and make informed decisions about how to improve it.
In our experience, the key to achieving good DMARC alignment is to carefully configure the DMARC records and automated email routing rules to work together seamlessly. This requires a deep understanding of how DMARC works and how it interacts with automated email routing rules.
By following the recommendations outlined in this section, customers can optimise their DMARC setup to achieve the best possible results and minimise the risk of emails being blocked or quarantined. Our team at DMARC Engine is always available to provide guidance and support to help customers achieve good DMARC alignment and improve the deliverability of their emails.
In terms of best practices, we recommend that customers regularly review their DMARC reports to identify any issues that may arise and make adjustments to their configuration as needed. We also recommend that customers use a hosted or managed DMARC setup, such as the one we provide, to simplify the process of configuring and managing their DMARC records.
By taking a proactive approach to DMARC alignment, customers can help