With free DMARC monitoring for Office 365, you can secure your travel to the cloud.

For IT administrators, not knowing who is sending emails ‘from’ your firm is a huge concern for two reasons.

One issue is “shadow IT,” which refers to cloud services that employees have signed up for without the knowledge of IT. Many of these services send mail that seems to be from your firm to workers, customers, or marketing prospects, exposing you to legal and security issues. Identifying and controlling these services is a vital step in any cloud migration strategy.

The second issue is phishing, which is involved in more than 90% of all cyberattacks. There is no more important weapon for phishers than the capacity to spoof senders. These con artists take advantage of the fact that there is little preventing them from spoofing whichever domain they choose in the ‘from’ box of their phishing emails.

DMARC

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a critical tool for addressing both of these issues. When an organization gets its domains to quarantine or reject policy—a process called DMARC enforcement—it receives total visibility and control over any email claiming to be from that organization. Read the “Best practices on installing DMARC in Office 365” section of the Microsoft article Using DMARC to verify email in Office 365 for additional information on DMARC policies and how they apply to inbound mail.

Before a corporation can implement an enforcement program, it must first identify all email senders who use its domain. If this critical and possibly difficult step is skipped, it may accidentally block valid email sources (such as a payroll provider or your CRM application) just because they haven’t been explicitly permitted.

While the benefits of DMARC are obvious, many companies have had difficulty implementing this open standard. DMARC instructs receiving mail servers to give aggregate data to domain owners so they may determine which services are sending email on their behalf. This information is useful for both cloud migration and anti-phishing operations.

However, extracting meaningful insight from these reports, which are often big XML files including extensive lists of IP addresses, can be challenging. Companies must conduct extensive “detective work” to determine which services’ correspond to those IPs and who within their organization is responsible for using those services, including updating the corresponding DMARC, Sender Policy Framework (SPF), and DomainKeys Identified Mail (DKIM) records to ensure that the services are properly authorized. Furthermore, each change necessitates the update of the Domain Name System (DNS), which can be a time-consuming operation.

Edge Ahead With EmailAuth

EmailAuth DMARC for Office 365 can greatly simplify this aspect of the DMARC journey. EmailAuth for Office 365 digests DMARC aggregate reports and converts them into an easily accessible list of named services, rather than manually parsing the vast quantity of XML-based IP address data seen in DMARC reports.

Furthermore, for each of these services, EmailAuth displays how many messages pass authentication and how many fail, as well as aggregate statistics on DMARC authentications and authentication failures. This significantly simplifies this crucial aspect of the DMARC process.

Setting up a DMARC record is straightforward—it’s basic txt record in DNS—and just three tags are required to construct a proper DMARC record. Once established, the domain owner receives daily aggregate reports through email from nearly every mail recipient in the globe that receives mail from that domain.

As previously said, the hard part is identifying all of the services that are sending email impersonating the domain using the DMARC aggregate data. Here’s why it’s difficult:

In the age of cloud computing, it’s normal for businesses to have hundreds of third-party services sending emails on their behalf. For example, a company’s core business may include CRM, HR, support, payroll, and other workflow services. The one element that connects all of these services is that they all rely on the firm’s domain name to send email—notifications, invoices, receipts, and so on—that must all originate ‘from’ the organization. Their usage of a domain name has become a de facto norm that capitalizes on the implicit confidence that workers, customers, and partners have in a firm while doing business with them.

Sender Identification

Before implementing an enforcement strategy, a corporation must be certain that it has accurately identified all of these senders, white-listed them in its SPF settings, and/or configured its DKIM keys. DMARC is extremely beneficial for preventing phishing attempts and protecting the brand, however, many Office 365 users who have adopted DMARC have yet to see it enforced.

They manually process DMARC reports using self-help tools or consultancy assistance. They examine millions of lines of XML in order to retrieve IP addresses, which they must then convert to identified services. Because these services may reside on multi-tenant clouds, determining the real identity of a specific service is made more difficult because the underlying cloud architecture may be shared and may change without notice.

EmailAuthfor Office 365 makes the service-discovery component of DMARC implementation far easier, providing a fully automated visibility service, free of charge so Office 365 users can easily see all third-party services sending on their behalf, as well as potential imposters that are spoofing their brand.

EmailAuth eliminates the need to wade through XML-based aggregate reports or try to interpret which IP addresses correspond to which cloud services. EmailAuth for Office 365 provides a clean, clear, human-readable interface that lists services and their email volume on the domain in plain English.