topic Re: Dmarc question in Peer-Peer Topics

Dmarc question

kcalderw — Tue, 19 Sep 2023 18:36:17 GMT

We had an issue this week where some of my staff received an email from "me" that asked them to click on a Google Doc link. They all knew it was fake but we received it several times this week. Spoke with Google support (no suspicious activity on my account) and they were spoofing. We looked over our records and made an adjustment to the dmarc TXT entry.

I'm curious what do you all have set for the p value? The options are none, quarantine, or reject.

Re: Dmarc question

Kim_Nilsson — Tue, 19 Sep 2023 18:40:12 GMT

reject

Has been set for years.

Re: Dmarc question

kcalderw — Tue, 19 Sep 2023 18:40:45 GMT

Apparently whomever set up our domain missed that step and had it set to none...

Re: Dmarc question

ddelboccio — Tue, 19 Sep 2023 18:50:52 GMT

Quarantine, 25%.

Can't pull the reject trigger like Kim does. LOL

Re: Dmarc question

kcalderw — Tue, 19 Sep 2023 19:14:02 GMT

This is our new setting. Any idea what fo=1 is?

v=DMARC1; p=quarantine; pct=25; fo=1;

Re: Dmarc question

ddelboccio — Tue, 19 Sep 2023 19:18:30 GMT

Forensic options. Allowed values: '0' to generate reports if both DKIM and SPF fail, '1' to generate reports if either DKIM or SPF fails to produce a DMARC pass result, 'd' to generate report if DKIM has failed or 's' if SPF failed.

Re: Dmarc question

ddelboccio — Tue, 19 Sep 2023 19:19:19 GMT

Check your here:

https://www.mimecast.com/products/dmarc-analyzer/dmarc-check/

Also explains all the tags.

Re: Dmarc question

ddelboccio — Wed, 20 Sep 2023 13:18:32 GMT

OK, under total respect for Kim Nilsson, I have finally set my DMARC policy to REJECT.

Re: Dmarc question

kcalderw — Wed, 20 Sep 2023 14:48:49 GMT

If things go south you can always blame Kim!