Sender Authentication

Sender Authentication – SPF, DKIM, DMARC etc. related things

1

How To Use Nslookup To Check TLS Reporting Record (TLS-RPT)

Posted on by Rhoderick Milne [MSFT]
NSLookup To Check TLS-RPT Record
As we move to add newer email security standards such as MTA-STS (Mail Transfer Agent Strict Transport Security) and DANE (DNS-Based Authentication of Named Entities), the reporting aspect of these standards needs to also be implemented.  Even though both MTA-STS & DANE enforce encryption, TLS Reporting (TLS-RPT) is what gives you visibility into whether that encryption is actually working or b
… Read the rest “How To Use Nslookup To Check TLS Reporting Record (TLS-RPT)”
0

Azure Communication Service Email – MX Record Required

Posted on by Rhoderick Milne [MSFT]
Azure Communication Service Email - MX Required

Azure Communication Services (ACS) can be used to send high volume outbound email to Internet recipients, represents an important shift in Microsoft’s messaging architecture. As organizations modernised their cloud communications to Exchange Online (EXO) many of them just kept doing what they were doing with Exchange on-premises, i.e. using that as a bulk mailer to send out high volume email inter… Read the rest “Azure Communication Service Email – MX Record Required”

0

How To Use Nslookup To Check DMARC External Domain Validation (EDV) Record

Posted on by Rhoderick Milne [MSFT]
DMARC RecordfCheck

Previously we looked at how to use nslookup to retrieve the main Domain Based Message Reporting And Conformance (DMARC) DNS record. One of the often overlooked and behind the scenes aspect of DMARC is that a 3rd party DMARC provider has to actually grant permission for DMARC reports to be sent to them for a given domain.  Without that permission, email service providers will not be able to send DM… Read the rest “How To Use Nslookup To Check DMARC External Domain Validation (EDV) Record”

1

Enable DMARC For OnMicrosoft.com Domains

Posted on by Rhoderick Milne [MSFT]
DMARC Record For onmicrosoft.com Domain

It is possible to add a Domain Based Message Authentication Reporting and Conformance (DMARC) record for your onmicrosoft.com domain in M365.

Is that a good thing?

Well, your viewpoint may depend on your experiences with this domain.  If you actually use the onmicrosoft.com domain to send email, then yes!  Adding the DMARC record enables the DMARC alignment check to pass and the mail to be successfu… Read the rest “Enable DMARC For OnMicrosoft.com Domains”

0

How to Use NsLookup To Check DKIM Record

Posted on by Rhoderick Milne [MSFT]
Check DMARC DNS Record Using NSLookUP

There are a multitude of online tools that help diagnose issues with various mail services, but understanding what these tools actually check is valuable.  One example is around manually checking published DomainKeys Identified Mail (DKIM) records.  DKIM is described in RFC 4871.  As an interesting piece of history DKIM went through a previous iteration "Domain-Based Email Authentication Using Pub… Read the rest “How to Use NsLookup To Check DKIM Record”

1

How To Use Nslookup To Check DMARC Record

Posted on by Rhoderick Milne [MSFT]
Check DMARC Using NSLookup

One of my customers wanted to verify their Domain Based Message Reporting Conformance (DMARC) record, and followed the post How To Use Nslookup To Check DNS TXT Record but ran into issues. They were not seeing any results.  Hmm strange; the DMARC record had been created and was visible in online diagnostic tools.  Why was it not showing up for them in a manual check?

The below is an example of what… Read the rest “How To Use Nslookup To Check DMARC Record”