DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that helps protect your domain from being used in spoofing and phishing attacks. It works by ensuring that incoming mail from your domain is properly authenticated via SPF or DKIM alignment with the FROM header.
In INKY, DMARC plays a crucial role in several features:
- For the Allow List, enabling DMARC authentication ensures that only emails passing DMARC checks will match your allow list entries. This prevents spoofed emails from bypassing security by pretending to be trusted senders. It's recommended to enable DMARC authentication for safer allow listing and only disable it if you need to allow unauthenticated mail. Additionally, you can use subdomain matching along with DMARC for flexibility when dealing with multiple sending subdomains.
- In the Trusted Third-Party Senders configuration, before mapping third-party services to your domains, you should check whether those services support SPF/DKIM/DMARC for your domain. If they are properly authenticated, INKY automatically treats their emails as legitimate without additional configuration.
- For the Known External Senders, only senders that pass SPF/DKIM/DMARC authentication get the "Known External" blue banner, increasing user trust while reducing unnecessary warnings.
- When creating a bypass list in Google Workspace, messages must pass DMARC authentication to be exempt from INKY bannering. This authentication requirement protects against spoofing and ensures only legitimate automated messages bypass INKY analysis.
Overall, DMARC validation is vital for INKY to correctly identify legitimate emails and help reduce false positives while maintaining security.
You can find more details and best practices about DMARC usage in the Allow List feature here: Allow List Overview.
To set up DMARC within INKY, follow these steps:
- Ensure You Have INKY Pro: DMARC Monitoring is only available with an INKY Pro license. Verify your organization is licensed for INKY Pro, as the DMARC Monitoring feature will not be visible otherwise.
-
Add a DMARC Record to Your DNS:
- Create a DMARC record in your DNS with the following format:
- Name: _dmarc.yourdomain.com
- Value: v=DMARC1; p=none; rua=mailto:your-reporting-address
- Update the rua value with your preferred reporting address.
- Make sure your SPF record includes INKY’s sending mechanisms.
- DKIM setup is not required by INKY directly; keep your mail provider’s DKIM enabled and configured.
-
Access DMARC Monitoring in INKY:
- In the INKY portal, navigate to Analysis > DMARC Monitoring.
- Here, you will see aggregated DMARC reports and diagnostic dashboards.
- Data may take up to 48 hours to update after DNS changes due to propagation timing.
-
Verify Record Visibility and Wait for Propagation:
- Use external tools (e.g., MXToolbox) to check that your DNS changes are globally visible.
-
Propagation can cause 24–48 hour delays before INKY begins ingesting reports.
Additional Notes:
- INKY’s DMARC Monitoring solution provides a dedicated reporting address to collect DMARC reports, aggregates and analyzes the data, and presents it in an intuitive dashboard for administrators.
- No additional DNS modifications are required beyond the DMARC record itself. INKY automatically integrates DMARC data based on the domains configured within your tenant or ingests external DMARC reports.
- If you do not see the DMARC Monitoring feature, confirm your licensing or contact Kaseya/INKY support for enablement.
Where to Find the Feature:
- DMARC Monitoring is accessed under the “Analysis” tab in the INKY admin portal. No backend enablement or special permissions are required beyond having INKY Pro and the correct domain configuration.
If you need more detailed guidance, refer to the DMARC Monitoring section in the INKY Knowledge Base or contact Kaseya support for step-by-step assistance.