Statistics report for SPF, DKIM DMARK ARC Alignment conformance

[joh2k]

Hello,

We're dealing with a significant spam issue, and we're considering implementing more strict AntiSpam profile settings like SPF, DKIM, and DMARC. However, I'm concerned that these changes might have a substantial impact by potentially sending legitimate emails to quarantine.

I'm wondering if there's a way for us to assess how well incoming emails align with these rules before we make any changes. For example, if FortiMAIL processed 10,000 messages today and SPF Fail was activated, resulting in all 10,000 messages being sent to quarantine, I'd like to know how many messages would be affected if SPF SoftFail were activated too.

Is there a way to generate a statistics report that can help us gauge the potential impact of implementing these AntiSpam profile changes before we actually go ahead with them?

Thank you for your assistance.

[spoojary · Accepted solution]

Before enforcing strict AntiSpam profile settings like SPF, DKIM, and DMARC, it's prudent to gauge their potential impact to ensure legitimate emails aren't unintentionally quarantined. Many email security solutions, FortiMAIL included, allow for a "monitor" or "report-only" mode. By enabling this mode, while not actually blocking or quarantining emails, the system logs results of these checks. After a set period, like a week or month, you can extract reports to see how many emails might fail each of the checks. The data might show that while many emails failing the SPF 'Fail' checks are spam, there might be legitimate ones flagged due to misconfigured settings on the sender's side. This requires attention before strict enforcement. An incremental approach is advisable; you can begin by enforcing stricter rules against emails with an SPF 'Fail' and then expand to DKIM and DMARC as you grow more confident. Maintaining an open line of communication with end-users is key; they'll inform you of any legitimate emails that get blocked, aiding in fine-tuning your settings. As threats and email patterns evolve, periodic reviews of these settings are crucial to ensure a balance between security and functionality.

[spoojary · Accepted solution]

Before enforcing strict AntiSpam profile settings like SPF, DKIM, and DMARC, it's prudent to gauge their potential impact to ensure legitimate emails aren't unintentionally quarantined. Many email security solutions, FortiMAIL included, allow for a "monitor" or "report-only" mode. By enabling this mode, while not actually blocking or quarantining emails, the system logs results of these checks. After a set period, like a week or month, you can extract reports to see how many emails might fail each of the checks. The data might show that while many emails failing the SPF 'Fail' checks are spam, there might be legitimate ones flagged due to misconfigured settings on the sender's side. This requires attention before strict enforcement. An incremental approach is advisable; you can begin by enforcing stricter rules against emails with an SPF 'Fail' and then expand to DKIM and DMARC as you grow more confident. Maintaining an open line of communication with end-users is key; they'll inform you of any legitimate emails that get blocked, aiding in fine-tuning your settings. As threats and email patterns evolve, periodic reviews of these settings are crucial to ensure a balance between security and functionality.

[AEK · Accepted solution]

Hello

I think SPF is the most important and must always be enabled. E-mails should also be spammed on SPF soft fail.

In new integrations I find it better to configure strict SPF filtering and then monitor for a couple of weeks the main domains I communicate with, then I whitelist them if needed.