topic Re: Gmail DMARC questions in Peer-Peer Topics

Gmail DMARC questions

kcalderw — Thu, 01 Feb 2024 14:07:56 GMT

I need to make some changes to our gmail to prevent spoofing. However, in my testing when I did this our own accounts that are used for voicemail to email relay and our scan to email addresses were blocked. We're having issues atm with people who have a district email and parent emails (BOE/teachers who are also parents) getting flagged and going to spam for possible spoofing.

v=DMARC1; p=none; fo=1;

If I set the p record to quarantine or reject, our relays stop functioning.

Re: Gmail DMARC questions

brodgers — Thu, 01 Feb 2024 14:13:38 GMT

Most likely the issue with people who have a district email and parent email is caused by a Gmail spam setting, not DMARC. In the control panel, look under Apps -> Google Workspace -> Settings for Gmail -> Safety for the setting "Protect against spoofing of employee names". If it is turned on, this is most likely your culprit.

Re: Gmail DMARC questions

ddelboccio — Thu, 01 Feb 2024 14:20:55 GMT

Are your relays settings correct under "settings for Gmail>Routing"?

I know I had to play around with the "allowed senders" and "authentication" settings.

Specifically for my voicemail to email setup, allowed senders is set to "any address (not recommended)" but I have the "Only accept mail from the specified IP addresses" option selected and the external IP address of my system defined.

Re: Gmail DMARC questions

Kim_Nilsson — Thu, 01 Feb 2024 14:21:50 GMT

That is the reason, but it's also doing it's job. 🙂

Re: Gmail DMARC questions

Kim_Nilsson — Thu, 01 Feb 2024 14:25:55 GMT

I've had DMARC reject for years. So happy. 🙂

We only use relay for two printers at the library. Nothing else is allowed to send as our Workspace.

Also, the account is a proper authenticated send, with a real user account.

Require SMTP Authentication is enabled, but TLS encryption isn't.

Re: Gmail DMARC questions

kcalderw — Thu, 01 Feb 2024 14:54:46 GMT

True... so just tell teachers to check their spam more often? Is that it?

Re: Gmail DMARC questions

Kim_Nilsson — Thu, 01 Feb 2024 17:11:38 GMT

I am in the process of activating 2FA for that account, and instead use an Application Password, as the current method will soon no longer be allowed. Shutting down in the fall/autumn.

Re: Gmail DMARC questions

Ron — Thu, 01 Feb 2024 20:15:31 GMT

@kcalderw wrote:
...our own accounts that are used for voicemail to email relay and our scan to email addresses...

Is this email being sent as authenticated users/accounts in your Google Workspace (i.e. the sent email appears in Gmail Sent for the users/accounts), or sent directly by/from systems (not relayed through Google mail)? If sent "off-Google", do you have SPF and/or DKIM set up for these systems?

@kcalderw wrote:
v=DMARC1; p=none; fo=1;

Are you sure? If I found the correct domain, you have:

v=DMARC1; p=quarantine; fo=1; rua=mailto:twp@twpschools.org

...at least for the parent domain. Maybe you're working with a subdomain...

It looks like you have DMARC aggregate reports (rua in DMARC record) sent to an email in your domain. I'm curious how you process/parse the reports for viewing? If you're using a certain tool/service and don't mind sharing, I'm interested. You might already be aware, but you can have multiple destinations for aggregate and forensic (ruf) reports. For example:

rua=mailto:rpts@agproc1.com,mailto:rpts@agproc2.com

In case you find it helpful, I like Postmark's free DMARC monitoring. I receive weekly DMARC digest emails from them, for various domains we have. It tells me the number of emails processed, the percentage of emails SPF or DKIM aligned (or both) and the percentage of emails SPF and DKIM not aligned (neither/nor). I'm not affiliated with Postmark in any way. Just like their service.

Re: Gmail DMARC questions

Kim_Nilsson — Thu, 01 Feb 2024 21:25:01 GMT

I too use the free Postmarkapp.

Just recently I also added Mailhardener.com for more detailed reporting. Also only the free version.

Re: Gmail DMARC questions

kcalderw — Fri, 02 Feb 2024 14:07:37 GMT

I made the change yesterday but now it seems our scan to email is going to spam. How did you prevent that?

Re: Gmail DMARC questions

ddelboccio — Fri, 02 Feb 2024 14:35:47 GMT

Settings for Gmail<Spam, Phishing & Malware> Spam> I added a rule of spam exceptions and included my domain as an exception, and made sure the "Bypass spam filters for messages from senders or domains in selected lists" setting is checked.

Re: Gmail DMARC questions

Kim_Nilsson — Fri, 02 Feb 2024 14:37:35 GMT

You should not have to exclude your own domain.

Re: Gmail DMARC questions

kcalderw — Fri, 02 Feb 2024 15:23:23 GMT

So the way Papercut works is that it has a few options. The way in our system it's currently set is that it emails a scan from the user's email to their email. I might change it to a separate email so it doesn't look like spoofing.

Re: Gmail DMARC questions

Kim_Nilsson — Fri, 02 Feb 2024 15:28:01 GMT

Yes, always avoid obvious spoofing.

Re: Gmail DMARC questions

kcalderw — Fri, 02 Feb 2024 20:16:58 GMT

Ron, I made the dmarc change after I originally posted. Thank you, I did sign up for Postmark.

The two services in question are using genuine Workspace accounts to email through the relay.

Re: Gmail DMARC questions

panderson — Fri, 02 Feb 2024 21:03:27 GMT

I like the idea of using the Postmarkapp but am not quite sure how to set it up.

so currently my dmarc record looks like this: v=DMARC1; p=none; rua=mailto:demarc-rep@mydoamin; ruf=mailto:demarc-forensic@mydomain; fo=1

the "postmarkapp" site says to add this to my txt record: v=DMARC1; p=none; pct=100; rua=mailto:re+ya4nccyiypy@dmarc.postmarkapp.com; sp=none; aspf=r;

If I wanted to have the reports go to my current email address and postmarkapps, what should my new txt record look like? Do I need to add the "pct=100" and "aspf=r"? From what I found "aspf" defaults to r (relaxed)

Would this work?: v=DMARC1; p=none; pct=100; rua=mailto:demarc-rep@mydoamin,mailto:re+ya4nccyiypy@dmarc.postmarkapp.com; ruf=mailto:demarc-forensic@mydomain; fo=1

Or what would the recommended record look like?

Re: Gmail DMARC questions

Kim_Nilsson — Fri, 02 Feb 2024 21:11:15 GMT

Check the TXT record for _dmarc.edu.lomma.se as it is as strict as possible, and has several rua recipients.

On DMARC recommendations, I don't use ruf, as it is said to log an unnecessary amount of details.

Re: Gmail DMARC questions

Ron — Fri, 02 Feb 2024 23:02:04 GMT

Do you have your Google Workspace SMTP relay service configured as specified by PaperCut, to allow the PaperCut Application server to send through the relay service? The Deprecated warning box at the top of that help center page is interesting... "This method of setting up an SMTP server using mail forwarding may still work for Google, but is no longer recommended." 🤔
We regularly use the SMTP relay service for a couple email sources (not PaperCut), with no problems.

Re: Gmail DMARC questions

Ron — Fri, 02 Feb 2024 23:11:18 GMT

Looks good to me, and passes this tool's DMARC record/policy syntax validation.

Re: Gmail DMARC questions

Ron — Fri, 02 Feb 2024 23:20:18 GMT

Also, in case it's helpful, I have used these to test DMARC/DKIM/SPF config and changes:

https://www.appmaildev.com
https://mxtoolbox.com/deliverability