How to Detect and Block Data Exfiltration Over DNS: Logging, Query Analysis, and Policy Rules in BIND and Windows DNS
Learn how to configure DMARC, DKIM, and SPF to reduce Business Email Compromise risk with a clear, step-by-step admin guide tailored for modern environments, so you can implement robust email authentication, achieve policy enforcement without breaking legitimate mail, and protect brand trust while maintaining deliverability.
Business Email Compromise thrives on spoofed identities, lookalike domains, and unauthorized senders. DMARC, DKIM, and SPF work together to verify the domain in the visible From header, authenticate messages, and instruct receivers to quarantine or reject failures.
List every domain you own, including primary, subdomains, parked domains, and legacy names. Map each sending source that uses your domains, such as Microsoft 365, Google Workspace, CRM platforms, marketing tools, ticketing systems, and transactional services.
Plan a staged rollout with testing windows. Assign owners for DNS changes and email platform settings. Prepare to monitor DMARC aggregate reports to validate coverage, find unauthorized senders, and tune alignment safely.
Confirm you can add and update TXT records at the root domain and relevant subdomains. Ensure TTLs are manageable during rollout so changes propagate quickly without creating instability.
Add a single TXT record at the root of each sending domain. Avoid multiple SPF records for the same name, as that breaks parsing.
Enable DKIM on each platform that sends on your behalf. Use distinct selectors per platform to support rotation and isolation.
Choose relaxed canonicalization for typical interoperability. Sign headers that remain stable across intermediaries, such as From, Date, Subject, and Message-ID. Ensure the DKIM d= domain aligns with the visible From domain for DMARC to pass via DKIM.
Start with a monitoring policy to observe your ecosystem without affecting delivery. Publish at _dmarc.example.com a TXT record with policy none and an aggregate reporting address you control.
Review who is sending on your behalf, which paths pass or fail SPF and DKIM, and whether alignment succeeds. Look for unauthorized sources, misconfigured vendors, and forwarding-induced failures.
After coverage is confirmed, transition cautiously to quarantine, then reject. Use the pct tag to ramp up enforcement gradually.
If you send DMARC reports to a third-party service, ensure the provider publishes the required external reporting authorization record per the DMARC specification. This typically appears as a TXT record under yourdomain._report._dmarc.providerdomain and confirms permission to receive your reports.
Publish Microsoft 365 SPF includes only once and ensure no duplicate records exist. Turn on DKIM in the admin center, create the two CNAME or TXT records for selectors, and enable signing. Align the From domain with the DKIM d= domain for DMARC to succeed.
Enable DKIM signing in the admin console, using a 2048-bit key where supported. Publish the selector’s TXT record and wait for propagation before enabling signing. Confirm SPF includes for outbound routing and any additional services.
For providers such as transactional email services or marketing tools, follow their documented steps to add SPF includes and publish DKIM selectors. Delegate a subdomain like mail.example.com so vendors can align DKIM and minimize risk to the apex domain.
Traditional forwarding can break SPF because the envelope sender is preserved while the connecting IP changes. Prioritize DKIM alignment so forwarded messages still pass DMARC via DKIM.
Mailing lists often modify Subject or body, invalidating DKIM. Many list managers support DMARC-friendly behavior such as From rewriting. Evaluate these settings for subscribed lists.
Parked domains are prime targets for spoofing. Publish restrictive records to prevent abuse while signaling receivers to reject impersonation attempts.
