CertaDNS

DMARC Practitioner

Operating DMARC: every tag including the ones nobody sets, how a receiver finds your policy, reporting at scale, staged enforcement with a rollback, and a triage method for failures.

lessons
22
total
4 h
level
Intermediate

Assumes DKIM Practitioner.

Start

You will be able to

  • Write a policy record that says exactly what you intend, sp and np included
  • Predict which record a receiver will apply to any given subdomain
  • Say what an aggregate report can and cannot tell you
  • Authorise an external report destination and prove it worked
  • Stage enforcement with criteria to proceed and a plan to revert
  • Triage a DMARC failure to one of four causes from the headers
  • Run DMARC across an estate of sending and non-sending domains

Syllabus

  1. 1. The Policy Record

    Every tag, the subdomain and non-existent-subdomain policies, and what pct really does.

    1. Every tag, including the unused ones12 min
    2. sp and np12 min
    3. What pct actually does10 min

  2. 2. Finding the Policy

    The two queries a receiver makes, the Public Suffix List, and delegating the record.

    1. The two queries11 min
    2. The Public Suffix List12 min
    3. Delegating the record10 min

  3. 3. Aggregate Reporting

    What a report omits, authorising an external destination, and choosing where they go.

    1. What a report does not contain11 min
    2. Sending reports somewhere else12 min
    3. Where to send them10 min

  4. 4. Failure Reports

    The fo values, and why almost nobody sends the reports they request.

    1. fo, and what each value asks for10 min
    2. Why almost nobody sends them10 min

  5. 5. Staged Enforcement

    Criteria to proceed, which half of the estate to enforce first, and how to revert.

    1. Evidence before policy12 min
    2. Which half of the estate first11 min
    3. The rollback10 min

  6. 6. Diagnosing Failures

    Four causes, the headers that separate them, and what ARC does about the fourth.

    1. Four causes, one method12 min
    2. Forwarding and mailing lists11 min
    3. ARC, in practice11 min

  7. 7. DMARC Across an Estate

    Non-sending domains, many domains under one policy, and inherited ones.

    1. Domains that send nothing10 min
    2. Fifty domains, one policy11 min
    3. Domains you inherit11 min

  8. 8. Operating DMARC

    What changes without you touching anything, and what to alert on.

    1. What changes without you11 min
    2. What to alert on10 min

  9. 9. Final assessment

    15 scenario questions · 80% to pass · unlimited retakes

    What the assessment covers

DMARC Practitioner

  • Complete every lesson in DMARC Practitioner
  • Pass the DMARC Practitioner assessment with at least 80%
About the certificates

CertaDNS Engineering · last reviewed