SY0-701 Question 330
Single answerA company recently moved its outbound marketing emails to a third-party cloud service. Soon after, customers report that messages from the company's domain are landing in spam or being rejected. The security administrator verifies that the provider is sending mail on behalf of the company's domain, but the messages are failing recipient authentication checks. The company wants to improve deliverability while also reducing the risk of domain spoofing. Which action should the administrator take FIRST?
- A
Update the domain's SPF record to include the third-party sender and enable DKIM signing for that service
- B
Set the DMARC policy to p=reject immediately so spoofed email is blocked by all recipients
- C
Configure the email gateway to strip all external sender addresses that do not match the company's internal domain
- D
Disable SPF and rely on the cloud provider's TLS encryption to prove message authenticity
Show answer and explanation
Correct answer: A
Explanation
The core issue is that a new third-party service is sending email for the organization's domain, but recipient systems cannot validate that service as an authorized sender. In practice, the first step is to authorize the service in SPF and configure DKIM signing with the organization's domain so messages can pass authentication checks. DMARC then uses the results of SPF and DKIM, along with alignment to the visible From domain, to tell receivers how to handle failures and where to send reports. A secure email gateway is valuable for filtering and policy enforcement, but it does not replace domain authentication controls for outbound deliverability. Best practices from RFC 7208 (SPF), RFC 6376 (DKIM), and RFC 7489 (DMARC) support establishing accurate SPF and DKIM configuration before enforcing stricter DMARC policies such as quarantine or reject.
- A. Correct.
Correct. When a legitimate third-party service sends email on behalf of a domain, the domain owner must authorize that sender in SPF and typically enable DKIM signing so recipient servers can validate message authenticity. DMARC depends on SPF and/or DKIM passing with alignment to the visible From domain. If the provider is not included in SPF or DKIM is not configured correctly, recipient systems may mark the messages as suspicious or reject them.
- B. Incorrect.
Incorrect. Moving directly to a strict DMARC enforcement policy can worsen mail delivery if SPF and DKIM are not already configured and aligned correctly. DMARC does not replace SPF or DKIM; it builds on them. Best practice is to validate legitimate sending sources first, often beginning with monitoring using p=none before moving to quarantine or reject.
- C. Incorrect.
Incorrect. A secure email gateway can help filter spam, malware, and spoofed messages, but it does not solve the root problem of recipient authentication failures for outbound mail sent by a legitimate third-party provider. This option also describes an overly broad control that could disrupt normal business communication.
- D. Incorrect.
Incorrect. TLS encrypts email in transit between servers when supported, but it does not authenticate the sending domain in the way SPF, DKIM, and DMARC do. Disabling SPF would remove an important anti-spoofing control and make domain-based validation weaker, not stronger.