Demo Buy

Monitoring domain health (DMARC and TLS)

Domain health makes DMARC and TLS reports readable: how much of the email sent on behalf of your domain passed authentication in the last 30 days, who is sending as you and when you can tighten your DMARC policy.

  • Organization administrator (permission to manage mailboxes)

What is monitoring domain health (DMARC and TLS)?

Domain health makes DMARC and TLS reports readable: how many of the emails sent on behalf of your domain in the last 30 days passed authentication, who is sending on your behalf, and when you can tighten your DMARC policy. Who can do this: Organization administrator (permission to manage mailboxes). If the report does not appear at all, check whether a rua address is defined in your DMARC record; reports usually arrive within 24-48 hours.

Steps

  1. In SmartMail Management, open the Domain health section.

  2. Read the card for each of your domains: the Verification pass rate, policy, recommendation 2, daily verification chart 1.

  3. Review the IPs in the Sources failing verification 3 table. The Service column shows whether the IP belongs to a recognised major corporate email service; the What to do 4 section below the table gives the include: line to add to your SPF record for that service and the recommendation to enable DKIM signing in the service's own dashboard. If the 'Unrecognised' IPs belong to a legitimate service of yours (newsletter, CRM), add them to your SPF/DKIM record; if you do not recognise them, someone is spoofing your domain.

Domain health: DMARC authentication rate, policy recommendation, daily chart, the service for sources that fail authentication and what to do
  1. 1Pass rate
  2. 2Concrete suggestion
  3. 3Spoofing or missing SPF
  4. 4SPF/DKIM recommendation by service
Domain health, with demo data.

How suggestions are provided

  • If the pass rate is below 90%, it is considered critical.
  • If the policy is none and the rate has been above 98% for at least 14 days, switching to quarantine is recommended.
  • If the policy is quarantine and the rate has been above 99% for at least 14 days, switching to reject is recommended.
  • If there is a failed session in encrypted delivery (TLS), it is mentioned first.
TipIf no report appears at all, check whether a rua address is defined in your DMARC record; reports usually arrive within 24-48 hours.
Retention periodThis screen summarises the last 30 days. Aggregate DMARC and TLS reports are retained for 400 days; older ones are deleted automatically every day.

Related pages