How To Move DMARC From Monitoring To Enforcement

This guide explains how to move DMARC from monitoring to enforcement.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication standard that helps protect your domain from email spoofing and phishing attacks. It works alongside SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to verify that emails sent from your domain are legitimate.

When implementing DMARC, it is recommended to begin with a monitoring policy before moving to enforcement. This allows you to review authentication results, identify any legitimate email sources that need to be authorised, and avoid accidentally blocking valid email. Once you are confident that your email authentication is configured correctly, you can update your DMARC policy to better protect your domain.

DMARC policies determine how receiving mail servers should handle emails that fail authentication:

• p=none: Monitors email authentication without affecting mail delivery.
• p=quarantine: Recommends that suspicious emails be delivered to the recipient’s spam or junk folder.
• p=reject: Instructs receiving mail servers to reject emails that fail DMARC authentication.

Moving gradually from monitoring to enforcement helps reduce the risk of legitimate emails being blocked.

Before You Begin

• Before updating your DMARC policy, ensure that:
• Your SPF record is correctly configured.
• DKIM signing is enabled for all legitimate email services.
• You have monitored your DMARC reports for a time.
• All authorised email providers are included in your SPF and DKIM configuration.

How To Move DMARC From Monitoring

Check Your Existing DMARC Record

1. Login to the Domains.co.za Customer Portal.

2. Open the Manage Services drop-down menu and select Web Hosting.

3. Click Manage next to the hosting package for your domain.

4. Click Edit DNS Records 

5. Locate the TXT Record for _dmarc.yourdomain.co.za.

6. Review the current DMARC policy.

Review Your DMARC Reports

Before changing your policy, review the aggregate reports you receive from mailbox providers.

• These reports can help you identify:
• Which servers are sending email on behalf of your domain.
• Whether SPF authentication passes.
• Whether DKIM authentication passes.
• Whether SPF or DKIM alignment passes.
• Unauthorised systems attempting to send email using your domain.

If you discover legitimate email services that are failing authentication, correct the SPF or DKIM configuration before moving to enforcement.

Update Your DMARC Policy

Once you are satisfied that your legitimate email sources authenticate successfully:

1. Edit your existing DMARC TXT record.

2. Change the policy from:

p=none
to:
p=quarantine

3. Save the updated DNS record.

4. Continue monitoring your DMARC reports for several days.

5. If no legitimate emails are failing authentication, update the policy to:

p=reject

6. Save the DNS changes.

NOTE:

DNS updates may take several hours to propagate across the internet.

Verify Your Configuration

After updating your DMARC policy:

• Send test emails to multiple email providers.
• Confirm that legitimate emails are delivered successfully.
• Continue reviewing DMARC aggregate reports.
• Check that SPF and DKIM authentication continue to pass.
• Investigate any unexpected authentication failures promptly.

Additional Information

• DMARC relies on both SPF and DKIM being correctly configured before enforcement should be enabled.
• Starting with a monitoring policy helps prevent legitimate emails from being rejected.
• Aggregate DMARC reports provide a summary of authentication results but do not contain the contents of email messages.
• A quarantine policy is a useful intermediate step before moving to a reject policy.
• If you use third-party services to send email, ensure they are included in your SPF record and support DKIM signing.
• Changes to your DMARC record may take time to propagate, so continue monitoring your reports after making updates.
• Reviewing your DMARC reports regularly helps maintain strong email security and protect your domain’s reputation.

Login to Domains.co.za Account

1. Go to the Domains.co.za website Account Login page.

2. Enter your Email and Password and click the Sign In button.

3. You will see the Domains.co.za Dashboard, displaying the Manage Account menu on the left and your Account Information, Account Overview and Open Support Tickets on the right.