Getting to an enforced policy without losing legitimate mail on the way.
It is being written. The outline below is what it will cover, and it is unlikely to change much. There is no enrolment and no date — when it is ready it will be on this page. Several of the lessons are built around tools on this site that already work, so you can practise the measurements today.
If you need this capability now rather than later, Advanced email security is the service that covers it, or talk to us.
Whoever owns the domain’s DNS and is being asked to "turn on DMARC" by a customer, an insurer or an auditor.
Practitioner. For people who administer these systems day to day.
Assumed beforehand:
4 modules, 11 lessons, 2 h 3 m of material. The times are the sum of the lessons rather than a round figure.
The reason DMARC enforcement loses mail is never the DNS. It is the system nobody remembered was sending.
The CRM, the invoicing platform, the ticketing system, the scanner in the corner, and the one marketing tool from three years ago.
Per-platform: what to add, and why a shared include is not a licence to add ten more.
Ten DNS lookups, counted during evaluation rather than in the record as written — which is why most checkers get it wrong.
Mechanisms in order, includes followed recursively, and where the count comes from.
Flattening, subdomain delegation, and the trade each one makes.
What a receiver does with each, and why softfail is where migrations go to die.
The half that survives forwarding, and the tags that quietly weaken it.
Key length, where the selector lives, and rotating without an outage.
Signing part of a body leaves the rest unprotected. Signatures that omit From verify a message whose sender can be replaced.
What each permits, and which one you actually want.
p=none teaches you what you have. The next two steps are where care is required.
The XML, what each failure class means, and separating forwarders from forgers.
Partial rollout, what pct= really does, and how long to sit at each stage.
Mailing lists, forwarded mail, and the ARC headers that let a receiver forgive both.
Format. Written lessons, each with a check you can run against your own domain using this site’s free tools. Delivery mechanism is not built yet.
These tools run the same checks the course teaches, and they work today. No account, and the ones marked as running in your browser send nothing anywhere.
Identity is the perimeter now. This is how to configure it without locking everyone out.
Course outline ⟶The attacks that pass SPF, DKIM and DMARC, and the habits that catch them anyway.
Course outline ⟶Addressing, DNS, DHCP and NAT — and a method for finding which of them is broken.
Course outline ⟶This course exists because the work behind it is work we do. If you need the result rather than the skill, advanced email security is the service that covers it.