DMARC Reports: securing outbound identity

DMARC Reports collects aggregate and forensic reports automatically, correlates SPF and DKIM and accompanies the staged path from p=none to p=reject.

DMARC Reports is the Conbool module for outgoing email identity. It collects the feedback of the recipient servers automatically through the existing mail flow and shows who sends in the name of your own domain.

DMARC Reports dashboard with pass rate, spoofing attempts and sending sources

Aggregated DMARC analysis, inbound and outbound.

What DMARC Reports does

Conbool is already the MX of the domain. A single TXT record with a rua address inside the tenant domain is enough, after which the reports come in without further action.

  • Aggregate reports: daily XML summary reports per sending source, analysed as a pass rate, a list of sending sources and a history.
  • Forensic reports: individual failed authentication attempts with header details for closer analysis.
  • Recommendations and alerts: concrete suggestions for raising the policy as well as email notification when the pass rate drops or unknown sending sources appear.

Separating inbound and outbound

DMARC Reports looks at outgoing identity, that is the misuse of your own domain by third parties. Inbound protection against spam, phishing and malicious attachments is handled by MailGuard. Both interlock: a detected spoofing attempt appears in the DMARC reports and is rejected at the gateway.

SPF and DKIM as the foundation

Every DMARC evaluation rests on the alignment of SPF and DKIM. How both methods work and how they are stored in DNS is explained in SPF and DKIM as the foundation of DMARC. The DKIM signature at domain level described there is to be distinguished from the per-message S/MIME signature in SecureMail certificates.

Staged path to p=reject

The path from pure observation with p=none to hard rejection with p=reject runs in stages so that no legitimate business mail breaks. The policy migration describes every stage. An enforced policy from p=quarantine is at the same time the precondition for BIMI, the display of the verified brand logo in the mailbox.

Getting started

First connect the domain, then create the DMARC record and afterwards analyse the aggregate reports. The Conbool DMARC product page gives an overview of the feature set.