220-1101 Question 117
Single answerDomain-based Message Authentication, Reporting, and Conformance (DMARC)A small company has recently moved to a cloud email provider. After the move, several customers report receiving fraudulent messages that appear to come from the company's domain. The IT technician verifies that SPF and DKIM are configured for the domain, but management wants better control over how receiving mail servers handle messages that fail authentication and wants visibility into abuse attempts. Which DNS change should the technician make to best meet these goals?
- A
Create a DMARC TXT record for the domain with a policy such as p=quarantine or p=reject and specify reporting addresses
- B
Add a second SPF TXT record listing all possible sending servers so receiving mail servers can block spoofed messages automatically
- C
Disable DKIM signing temporarily so fraudulent messages are easier to identify in mail headers
- D
Create an MX record that routes suspicious messages to a separate mailbox for administrator review
Show answer and explanation
Correct answer: A
Explanation
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is designed to build on SPF and DKIM by adding domain alignment, policy enforcement, and reporting. In a real-world support scenario, if a company already has SPF and DKIM but still needs stronger protection against spoofed mail and wants insight into attempted abuse, publishing a DMARC record is the appropriate next step. Common tags include p=none for monitoring, p=quarantine to send failing messages to spam/junk handling, and p=reject to refuse them. Reporting tags such as rua and ruf can provide aggregate and, where supported, forensic reporting. Best practice is usually to start with monitoring, review reports, then move to stricter enforcement once legitimate senders are properly aligned. This aligns with guidance from the DMARC standard (RFC 7489) and common email security best practices from major mail providers.
- A. Correct.
Correct. DMARC is published as a DNS TXT record at _dmarc.domain and tells receiving mail servers what to do when a message fails DMARC evaluation, typically based on SPF and/or DKIM alignment. A policy of p=quarantine or p=reject helps reduce successful spoofing, and aggregate/reporting tags such as rua give the organization visibility into authentication failures and abuse attempts. This directly addresses both enforcement and reporting goals in the scenario.
- B. Incorrect.
Incorrect. A domain should not publish multiple SPF records; doing so can cause SPF PermError and break validation. Also, SPF by itself does not provide the policy and reporting framework management requested. DMARC is the standard mechanism used to instruct receivers how to handle failed authentication and to receive reports.
- C. Incorrect.
Incorrect. Disabling DKIM would weaken email authentication rather than improve it. DKIM helps validate that messages were authorized and not altered in transit. Fraudulent messages are not made easier to stop by removing DKIM; instead, DMARC uses DKIM and SPF results to apply policy.
- D. Incorrect.
Incorrect. MX records identify mail exchangers for receiving mail for a domain; they do not define anti-spoofing policy for external receiving servers. Creating or changing an MX record would not tell other organizations how to treat unauthenticated messages claiming to be from the company's domain.