For anyone sending more than 5,000 emails per day to the world’s largest mailbox providers, here’s what you need to do:

Implement a DMARC Policy

To comply with Google and Yahoo’s new requirements, you must have a DMARC policy in your DNS. While a monitoring policy (p=none) is acceptable for initial compliance, this is just the first step in leveraging DMARC’s full security benefits.

• Check if you have a DMARC record using our DMARC Inspector.
• If you don’t have a DMARC record, generate one with our DMARC Record Wizard.
  • Most DMARC implementations begin with a monitoring mode (p=none). This is the default setting in our Wizard.
  • Once created, the DMARC record must be published in your DNS.
• Enable DMARC monitoring to identify any non-compliant email sources.
• Leverage a visualization tool to interpret DMARC reports effectively. You can start a 30-day trial with us for insights into your domain’s security posture and step-by-step guidance.

Ensure Your Messages Pass DMARC Alignment

For emails to be DMARC-compliant, they must pass authentication in one of two ways:

1. DKIM Alignment: Your email must pass DKIM authentication, where the domain used in the d= field of the DKIM signature matches the domain in the From: header.

2. SPF Alignment: Your email must pass SPF authentication, where the domain used in the Return-Path (sometimes called “bounce domain,” “envelope-from,” or “MailFrom”) matches the domain in the From: header.

Of these two methods, DKIM is generally the preferred and more reliable option, as it remains intact even when emails are forwarded. This ensures better deliverability and reduces authentication failures.

Following the recommendations of Google and Yahoo postmasters, DMARCtron also advocates for a DKIM-first approach to DMARC compliance. However, maintaining a valid SPF record is still essential for optimal email authentication and security.

For proper email delivery and security, your sending IPs must have a PTR record, also known as forward and reverse DNS or a hostname.

• If you manage your own mail servers, it’s essential to validate that each sending IP address has a corresponding PTR record in your DNS to ensure proper email handling.
• If you use third-party email vendors, this responsibility falls on them. Basic DMARC monitoring (p=none) can help ensure that your email vendors are compliant with the necessary email standards, including PTR records.

It is uncommon for legitimate mail servers to lack a PTR record. However, attackers have started to exploit other connected devices, such as smart devices or residential modems, to send email. The absence of a PTR record is a strong indication to the receiver that the IP address is not properly configured to send email, which may result in your emails being flagged as suspicious or undelivered.