DMARC only monitoring

Why it matters

p=none is a good first step, because you learn which mail passes. But receivers still deliver fake mail. Only quarantine or reject actually protects your clients from mail in your name.

How Snaglist checks it

This is part of the security check, a separate check next to the crawl, in Studio and Bureau, and only on a site you have verified. Snaglist only looks at what any visitor can see from outside. It never logs in, guesses no passwords and sends no attacks. It reads the DMARC record of the domain and checks the policy.

Common causes

• The record was set up as a test and never tightened
• Doubt whether all real mail passes
• Nobody reads the reports

How to fix it

1. Check in the reports that all your real mail passes SPF or DKIM.
2. Set the record to p=quarantine.
3. After a few quiet weeks, set it to p=reject.
4. Run the security check again to confirm.

How it shows in the report

In the report for your client this appears under the heading "Fake mail from your domain is reported, but not stopped". When everything is in order, the report says: "The DMARC policy stops fake mail".