Security finding
DMARC is missing or not enforced; DKIM and MTA-STS were not found
Security Warning Severity: Medium
Part of the audit Email authentication records. Finding id: security.emailDmarc.
What it costs you
Without a working rule, anyone can send mail that shows your domain as the sender, and the receiving server has no instruction to refuse it. Customers get invoices and password mails that look like yours. DMARC is the record that tells receivers what to do with such mail and where to report it.
What to do
Publish a DMARC record, read the reports, and move the policy from none to quarantine to reject. Web teams rarely own DNS: pass this to whoever does.
What it checks
- No policy for failed email checks
- Failed emails are not blocked or quarantined
- Email signing keys found
- Email servers must use secure connections
How to fix it
Publish DMARC and tighten it in steps
Switch on DKIM signing
- Send yourself a mail from each system that sends as your domain and look for a DKIM-Signature header.
- Where it is missing, switch on signing in that service and publish the key record it gives you.
How to check: The headers of a new mail show a DKIM-Signature line with d= set to your domain.
Publish an MTA-STS policy
- Serve the policy file at https://mta-sts.example.com/.well-known/mta-sts.txt (use your own domain), with mode testing at first.
- Publish the TXT record _mta-sts.example.com with v=STSv1 and an id that you change with every policy change.
- Change the mode to enforce once the mail hosts in the policy all pass.
How to check: dig +short TXT _mta-sts.example.com; curl -s https://mta-sts.example.com/.well-known/mta-sts.txt (use your own domain)
A real case
When the UK tax authority HMRC tried DMARC in 2016, 300 million fake emails sent in its name were stopped that year instead of reaching inboxes.