hmLoadTopic({
hmKeywords:"DMARC,DMARC filtering messages to Junk E-mail,DMARC refusing failed messages,DMARC restrictive policies,DMARC Verificaiton",
hmTitle:"DMARC Verification",
hmDescription:"DMARC Verification Enable DMARC verification and reporting When this option is enabled, MDaemon will perform DMARC DNS queries on the domain found in the From: header of incomi",
hmPrevLink:"security--dmarc.html",
hmNextLink:"security--dmarc_reporting.html",
hmParentLink:"security--dmarc.html",
hmBreadCrumbs:"<a href=\"security_menu.html\">Security Menu<\/a> &gt; Security Manager &gt; Sender Authentication &gt; <a href=\"security--dmarc.html\">DMARC<\/a>",
hmTitlePath:"Security Menu > Security Manager > Sender Authentication > DMARC > DMARC Verification",
hmHeader:"<h1 class=\"p_Heading1\" style=\"page-break-after: avoid;\"><span class=\"f_Heading1\">DMARC Verification<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_BodyText_Center\"><img style=\"margin:0 auto 0 auto;width:32.5625rem;height:26.9375rem;border:none\" src=\".\/images\/sender-authentication_dmarc-verification.png\"\/><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">DMARC Verification<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Enable DMARC verification and reporting<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">When this option is enabled, MDaemon will perform DMARC DNS queries on the domain found in the <\/span><span class=\"f_PlainText\">From:<\/span><span class=\"f_ControlIndent\"> header of incoming messages, and it will send aggregate and failure reports if you have set it to do so on the <a href=\"security--dmarc_reporting.html\" class=\"topiclink\">DMARC Reporting<\/a> screen. DMARC uses <a href=\"security--spf__sender_id.html\" class=\"topiclink\">SPF<\/a> and <a href=\"security--dkim_verify.html\" class=\"topiclink\">DKIM<\/a> to validate messages, therefore at least one of those features must be enabled before DMARC can be used. DMARC verification and reporting is enabled by default and should be used in most MDaemon configurations.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/forbidden_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">Disabling support for DMARC could allow an increase in spam, phishing, or otherwise forged messages getting to your users. It could also cause some of your mailing list messages to be rejected by other servers and even cause some list members to be dropped from your lists. You should not disable DMARC unless you are absolutely sure that you have no need of it.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Do not verify messages from authenticated sessions<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">By default MDaemon will not perform DMARC queries on messages that are received over an authenticated session. Authenticated sessions include those verified by <a href=\"security--smtp_authentication.html\" class=\"topiclink\">SMTP Authentication<\/a>, <a href=\"security--pop_before_smtp.html\" class=\"topiclink\">POP before SMTP<\/a>, or the <a href=\"security--ip_shielding.html\" class=\"topiclink\">IP Shield<\/a>.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Do not verify messages from trusted IPs<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">By default MDaemon will not perform DMARC queries on messages that are coming from a <a href=\"security--trusted_ips.html\" class=\"topiclink\">trusted IP address<\/a>.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Cache DMARC records<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">By default MDaemon will cache the DMARC record data found during the DNS lookup. By temporarily caching this information, you can increase efficiency when processing similar messages that arrive in the near future from the same domain.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Cache<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">This button opens the DMARC cache, which lists all currently cached DMARC records.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Exempt list<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this button to open the DMARC<\/span><span class=\"f_ControlIndent\"> exempt list. Messages originating from any IP addresses specified on the list will not be subject to DMARC verification.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">DMARC Verification also honors <a href=\"security--certification.html\" class=\"topiclink\">VBR certification<\/a>, and the <a href=\"security--approved_list.html\" class=\"topiclink\">Approved List<\/a>, which can<\/span><span class=\"f_Notes\"> exempt based on verified DKIM identifiers and SPF paths from sources you trust. So, for example, if a message arrives that fails the DMARC check but has a valid DKIM signature from a domain on the Approved List, the message is not subject to punitive DMARC policy (i.e..the message is treated as if the policy were &quot;p=none&quot;). The same happens if SPF path verification matches a domain on the Approved List.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">DMARC Message Disposition<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Honor p=reject when DMARC produces a \'FAIL\' result<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">By default this option is enabled, meaning that MDaemon will honor the <\/span><span class=\"f_PlainText\">p=reject<\/span><span class=\"f_ControlIndent\"> DMARC policy when a message\'s <\/span><span class=\"f_PlainText\">From:<\/span><span class=\"f_ControlIndent\"> domain has published that policy in its DMARC record and the message fails DMARC verification. Messages failing DMARC verification will be refused during the SMTP session.<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">When this option is disabled and a message fails DMARC verification, MDaemon will insert the &quot;<\/span><span class=\"f_PlainText\">X-MDDMARC-Fail-policy: reject<\/span><span class=\"f_ControlIndent\">&quot; header into the message instead of refusing to accept it. In that case you could use the Content Filter to perform some action based on the presence of that header, such as sending the message to a specific folder for further scrutiny. Further, you could use the &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Filter messages which fail the DMARC test into spam folders<\/span><span class=\"f_ControlIndent\">&quot; option below to cause the message to be placed into the recipient\'s spam folder.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">Even if you leave this option disabled, the message could still be rejected for some other reason unrelated to DMARC, such as having a <a href=\"sf_spam_filtering.html\" class=\"topiclink\">Spam Filter score<\/a> above the permitted threshold.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Filter messages which fail the DMARC test into spam folders<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Enable this option if you wish to filter messages automatically into the recipient account\'s spam (i.e. junk e-mail) folder whenever a message fails DMARC verification. If this folder doesn\'t yet exist for the user, MDaemon will create one when needed.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">When enabled, this option is only applied when the From: domain has published a restrictive DMARC policy (i.e. p=quarantine or p=reject). When the domain publishes a p=none policy then that indicates that the domain is only monitoring DMARC and no punitive measure should be taken.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_SeeAlso\" style=\"page-break-after: avoid; border-right: none; border-bottom: none; border-left: none;\"><span class=\"f_SeeAlso\">See:<\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"security--dmarc.html\" class=\"topiclink\">DMARC<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"security--dmarc_reporting.html\" class=\"topiclink\">DMARC Reporting<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"security--dmarc_options.html\" class=\"topiclink\">DMARC Settings<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"ml_options.html\" class=\"topiclink\">Mailing List » Settings<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"ml_headers.html\" class=\"topiclink\">Mailing List » Headers<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"security--approved_list.html\" class=\"topiclink\">Approved List<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\">&nbsp;<\/span><\/p>\n\r"
})
