{"id":89489,"date":"2019-06-03T09:00:33","date_gmt":"2019-06-03T16:00:33","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/?p=89489"},"modified":"2023-05-15T23:09:13","modified_gmt":"2023-05-16T06:09:13","slug":"secure-cloud-free-dmarc-monitoring-office-365","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/06\/03\/secure-cloud-free-dmarc-monitoring-office-365\/","title":{"rendered":"Secure your journey to the cloud with free DMARC monitoring for Office 365"},"content":{"rendered":"
This blog post is part of the Microsoft Intelligence Security Association (MISA) guest blog series<\/a>. To learn more about MISA, visit the MISA webpage<\/a>.<\/em><\/p>\n Not knowing who is sending email \u201cfrom\u201d your organization is an enormous problem for IT managers for two reasons.<\/p>\n One problem is \u201cshadow IT\u201d\u2014cloud services that employees have signed up for without IT oversight. Many of these services send mail\u2014to employees, customers, or marketing prospects\u2014which appear to come from your organization, opening you to legal and security risks. Identifying these services and getting them under control is a critical step in any cloud migration project.<\/p>\n The second problem is phishing, which plays a role in over 90 percent of all cyberattacks. For phishers, there\u2019s not a more valuable tool than the ability to impersonate senders. These scammers rely on the fact that there is little stopping them from spoofing any domain they like in the \u201cfrom\u201d field of their phishing messages.<\/p>\n Domain-based Message Authentication, Reporting, and Conformance (DMARC) is an essential tool for solving both of these problems. When an organization gets its domains to a quarantine or reject policy\u2014what\u2019s known as DMARC enforcement\u2014it gains complete visibility into and control over all email purporting to be from that organization. For more on DMARC policies and how they pertain to inbound mail, read the \u201cBest practices on implementing DMARC in Office 365\u201d section in the Microsoft article Using DMARC to validate email in Office 365<\/a>.<\/p>\n Before a company can get to an enforcement policy, it needs to identify all the email senders using its domain. If this crucial and potentially challenging step is omitted, it may wind up inadvertently blocking legitimate email sources (like a payroll provider or your CRM tool), simply because it hasn\u2019t specifically authorized them.<\/p>\n While the benefits of DMARC<\/a> are clear, many organizations have had trouble with the implementation of this open standard. DMARC directs receiving mail servers to send aggregate reports back to domain owners, so they can analyze which services are sending mail on their behalf. This data is valuable for both cloud migration and anti-phishing projects.<\/p>\n But it can be difficult to extract actionable intelligence from these reports, which are typically large XML files containing long lists of IP addresses. Companies need to do extensive \u201cdetective work\u201d to figure out which services correspond to those IPs and which people within their organization are responsible for using those services, which includes updating the corresponding DMARC, Sender Policy Framework (SPF), and DomainKeys Identified Mail (DKIM) records to ensure that the services are properly authorized. What\u2019s more, every change requires updating the Domain Name System (DNS), which itself can be an involved process.<\/p>\n What if you don\u2019t have the time and resources to allocate to this long-term, sometimes tedious technical analysis?<\/p>\n Valimail Monitor for Office 365<\/a> can make this part of the DMARC journey much easier. Instead of manually parsing the massive amount of XML-based IP address data you get in DMARC reports, Valimail Monitor for Office 365 digests DMARC aggregate reports and turns them into an easily readable list of named services. In addition, for each of these services, Valimail shows how many messages are passing authentication and how many are failing and provides overall stats on DMARC authentications and authentication failures. This greatly simplifies this critical stage of the DMARC journey.<\/p>\n <\/a><\/p>\n Setting up a DMARC record isn\u2019t difficult\u2014it\u2019s a simple txt record in DNS\u2014and there are only three tags needed to configure a correct DMARC record<\/a>. Once configured, the domain owner receives daily aggregate reports, via email, from virtually every mail receiver worldwide that gets mail from that domain.<\/p>\n The challenging part, as noted above, is using those DMARC aggregate reports to identify all those services that are sending email \u201cas\u201d the domain.<\/p>\n Here\u2019s why it\u2019s hard: In the era of cloud IT, it\u2019s quite common for organizations to have dozens of third-party services sending email on their behalf. For example, an organization may have CRM, HR, support, payroll, and other workflow services that are core to its business. The one thing that ties all these services together is that they all rely on the company\u2019s domain name to send email\u2014notifications, invoices, receipts, and the like\u2014which all need to come \u201cfrom\u201d the company. Their use of a domain name is a defacto standard that leverages the implicit trust employees, customers, and partners have when they do business with a company. (Watch a short one-minute video explaining why so many DMARC projects run into trouble<\/a>.)<\/p>\n Before moving to a policy of enforcement, a company needs to have the confidence that it has correctly identified all these senders and white-listed them in its SPF configuration, and\/or configured their DKIM keys correctly.<\/p>\n DMARC is incredibly useful to block phishing attacks and protect the brand, but many Office 365 customers who have implemented DMARC have not reached enforcement. They\u2019ve manually parsed DMARC reports with self-help tools or consulting support. They\u2019ve looked at millions of lines of XML to extract IP addresses which they then need to translate to named services. These services themselves may live on multi-tenant clouds, so discerning the true identity of a given service is further challenging because the underlying cloud infrastructure could be shared and may change without notice.<\/p>\n Valimail Monitor for Office 365<\/a> makes the service-discovery component of DMARC implementation far easier, providing a fully automated visibility service, free of charge. With Valimail, Office 365 users can easily see all third-party services sending on their behalf, as well as potential imposters that are spoofing their brand. It eliminates the need to wade through XML-based aggregate reports or try to interpret which IP addresses correspond to which cloud services. Valimail Monitor for Office 365 provides a clean, clear, human-readable interface that lists services and their email volume on the domain in plain English.<\/p>\n <\/a><\/p>\n With full visibility, Office 365 customers will be armed with all the information they need to determine which services are legitimate and authorized. From there, they\u2019ll be in a position to confidently move their organization to full DMARC enforcement, where all unauthenticated traffic is blocked. Valimail makes this easy as well, with an upgrade path to Valimail Enforce<\/a>, which fully automates DMARC enforcement.<\/p>\n As a member of the Microsoft Intelligent Security Association<\/a>, Valimail provides a critical free service for Office 365 customers who want the benefits of DMARC enforcement. DMARC enforcement, together with the anti-spoofing and anti-phishing capabilities in Office 365, will effectively stop an entire class of phishing attacks.<\/p>\n Here\u2019s how to get started with Valimail Monitor for Office 365:<\/p>\nThe challenge is identification<\/b><\/h3>\n
A fully automated, free service<\/b><\/h3>\n
Configuring Valimail Monitor for Office 365<\/h3>\n
\n
\nNote<\/em><\/strong>: This is a free service for Office 365 customers. Once you sign up, Valimail will email you the simple configuration instructions.<\/em><\/li>\n