Posts Tagged ‘DKIM’
Recently had a customer have a bounce back for an email someone tried to send him with the error
DNS Authentication – DMARC Fail
DMARC Utilises DKIM and SPF records to monitor senders and act accordingly. I checked the domain of the sender’s email using https://otalliance.org/resources/spf-dmarc-tools-record-validator and the domain had no DKIM or SPF but did have a DMARC Record!
You need to have SPF and DKIM records before DMARC
An email from this sender could not be delivered to your mailbox as it has failed DKIM verification. To comply with government security standards the ATO cannot accept emails that fail DKIM integrity checks because the email cannot be verified as genuine.
Currently there is an issue causing emails from organisations using Office 365 to fail DKIM verification.
Office 365 has implemented its own DKIM features and customers must ensure that outbound DKIM is correctly configured for their domain (DNS) and namespace (Office 356 Administration).
How to enable DKIM on 365
You will need to enable DKIM outbound DNS Verification on either 365
These need to point to
Your onmicrosoftalias is the domain GUID and can be retrieved from the MX record for your domain
You then need to enable
View Powershell :
New-DkimSigningConfig –DomainName domain.com –Enabled $true
Or through GUI :
If you send out via another provider e.g. a spam filter you will need to check the method on the spam filter of enabling this
There’s been a new recent wave of spoof emails sent to companies , usually emailed to financial personnel’s pretending to be from the CEO to get quick funds paid and withdrawn.
Spoofing an email address isn’t hard and with the correct background check , spammers get the correct email and sometimes signature of the “CEO”.
How do we stop this?
- To start with SPF, DKIM, DMARC records should all be added to the domain to verify the sender to check they are allowed to send from the company domain
- You should definitely have an incoming spam filter before Microsoft Exchange , depending if this is a Barracudo box / Post fix / Microsoft Frontbridge you should be able to enable a Rule to SPF check for only your domain. Enabling this for all domains will starting to spam lots of incoming email due to people not having SPF records
- Create a quarantine in Exchaneg – From EMC > Organization Configuration > Hub Transport > Transport Rules create a new transport rule that says:
From users that are outside the organization
And when the from address matches text patterns yourdomain.com
Forward the message to firstname.lastname@example.org for moderation
Now, if you have other SMTP servers in or out of your org that send on behalf of your domain, you’ll need to create an exception by adding:
Except when the message header received matches text patterns smtp.yourdomain.com or smtp.theirdomain.com
You can forward these emails to : email@example.com or use the Outlook plugin to report and hopefully Microsoft should block these in future : https://www.microsoft.com/en-us/download/details.aspx?id=18275
Microsoft have actually now got a new filtering service for 365 however its paid for and by user you could maybe try : https://products.office.com/en-us/exchange/online-email-threat-protection
It’s not uncommon nowadays to have another third party appliance such as a barracuda or a hosted service such as post fix to filter items before they get to 365. It seems once a spammer figures out how to exploit 365 , all domains get the same spam. 2 layers of protection is safer!
1) Make sure your own SPF Records are in check : http://www.spfwizard.net/
2) Get your DKIM records in check : http://blogs.msdn.com/b/tzink/archive/2015/10/08/manually-hooking-up-dkim-signing-in-office-365.aspx
3) Get your DMARC Records in check : http://blogs.msdn.com/b/tzink/archive/2014/12/03/using-dmarc-in-office-365.aspx