What's the latest advice on DMARC, DKIM and SPF for Office 365 tenants?
I have configured SPF records with the Office 365 include for all domains that I manage as a minimum.
I have configured DMARC records in 'Monitor' for a few recent tenants recently, but I am yet to roll this out for all domains/tenants.
I have not configured custom DKIM for any tenants - I know that Office 365 has Default DKIM Signing configured (which is based on the default tenant domain name that you are given with all new tenants).
Microsoft recommend configuring DKIM if;
- You have more than one domain in Office 365
- You're going to set up DMARC too (recommended) - I can only assume DMARC doesn't work correctly with default DKIM don't work, hence the need to configure custom DKIM records?
- You want control over your private key
- You want to customize your CNAME records
- You want to set up DKIM keys for email originating out of a third-party domain, for example, if you use a third-party bulk mailer.
I'm trying to work out if I should set up all three of the above for all the tenants I manage? None have more than 35 users so I would classify them as SMBs.
I think if you're going to configure DKIM, you should configure DMARC to give instructions to recipient mail servers on what action to take if SPF and DKIM fail.
I have looked at DMARC reports in the past (never received a forensic report - I don't think many mail providers generate these yet?) and cannot make much sense out of the detail included.
Any advice appreciated.
Thanks
