sus.botdocs

Security finding

The DMARC policy applies to only part of the failing mail

Security Warning Severity: Low

Part of the audit Email authentication records. Finding id: security.emailDmarcPct.

What it costs you

Mail that fails DMARC and falls outside the percentage is treated more mildly: under reject it is only quarantined, under quarantine it goes through the receiver's normal filtering. Part of the forged mail in your name still gets through.

What to do

Once the reports show your own mail passes, remove pct or set it to 100.

What it checks

  • Email policy applies to only some messages

How to fix it

Apply the policy to all failing mail

  1. At the DNS host, edit the TXT record at _dmarc of your domain: remove the pct tag, or set pct=100. Keep the other tags as they are.
  2. Raise it in steps (25, 50, 100) if you are not yet sure all your own mail passes, and read the aggregate reports between steps.

How to check: dig +short TXT _dmarc.example.com (use your own domain; no pct, or pct=100)