1. Domain-based Authentication, Reporting, and Conformance
DMARC
Domain-based Authentication, Reporting, and Conformance
DMARC
for campus

2. Domain-based Authentication, Reporting, and Conformance
DMARC
Domain-based Authentication, Reporting, and Conformance
What is DMARC?
An standard that allows providers to to verify that was sent from a valid address.
Case 1: from to
Gmail asks WiscMail servers, “Is this legitimate?”
WiscMail servers, “Yes, that is legitimate. Bucky rocks!”
Gmail delivers mail to

3. Domain-based Authentication, Reporting, and Conformance
DMARC
Domain-based Authentication, Reporting, and Conformance
How does
DMARC work?
systems “talk” to each other using the DMARC standard to verify senders are legitimate.
Case 2: from to
WiscMail servers ask MSU servers, “Is this legitimate?”
MSU, “Nope! We don’t know who that is!”
WiscMail potential actions include:
deliver
block
quarantine
discard

4. Domain-based Authentication, Reporting, and Conformance
DMARC
Domain-based Authentication, Reporting, and Conformance
Who is impacted by this change?
Any system “spoofing” or impersonating a UW Madison addresses
UW-Madison users who send messages thru 3rd- party mass providers (e.g. MailChimp, Constant Contact, etc.) using address as the “From” address.*
Non-UW-Madison accounts which send as an @wisc.edu address (e.g. Gmail account configured to send as address).
Third-party scripts/servers that don’t send using on-campus mail services which are sending “FROM” a wisc.edu address.
* Can be configured to send DMARC compliant

5. Domain-based Authentication, Reporting, and Conformance
DMARC
Domain-based Authentication, Reporting, and Conformance
Who is not impacted by this change?
UW-Madison Office 365 web client, desktop app, and mobile app
Individuals sending outbound
Office 365 add-ons for mail-merge functionality
Systems which are able to authorize end-users’ use of their own address within the system
List servers configured to work with DMARC*
UW-Madison lists
Google Groups 
UW-Madison campus SMTP Relay service
*Departmental and off-campus list servers need to be updated to support DMARC

6. Domain-based Authentication, Reporting, and Conformance
DMARC
Domain-based Authentication, Reporting, and Conformance
How does this impact UW Madison inbound/outbound messages?
Inbound
Inbound messages (from any source other than the UW- Madison Office 365 tenant) which spoof address will be flagged as SPAM.
These messages will either be rejected by the system, quarantined, or delivered to the intended recipient’s SPAM folder.
Outbound
Recipient systems (e.g. Gmail, etc.) will reject or quarantine messages which spoof address.

7. Domain-based Authentication, Reporting, and Conformance
DMARC
Domain-based Authentication, Reporting, and Conformance
What can you do to ensure you are compliant with DMARC standards?
Faculty/Staff/Students
No changes necessary unless they are sending messages from a non-UW service which is “spoofing” an @wisc.edu address.
Domain/Application/System Admins
See the DMARC Website for more information on how to achieve DMARC compliance.
Contact 3rd-Party providers to determine if they are capable of DMARC compliance.
If you manage a system which sends through a mechanism other than UW Madison mail relay, contact the ECC Team for a consultation.

8. Domain-based Authentication, Reporting, and Conformance
DMARC
Domain-based Authentication, Reporting, and Conformance
What is the
timeline?
Current and Ongoing
Execute communication plan
Develop domain policies with Hostmaster
Convert campus relayers
Fall/Winter 2018
Tag subjects of inbound mail violating DMARC standard
Publish SPF ~all for wisc.edu (following conclusion of Spring semester)
Spring/Summer 2019 (Tentative)
Publish 1% DMARC record for wisc.edu
Fall 2019 (Tentative)
Publish DMARC record for wisc.edu

9. Domain-based Authentication, Reporting, and Conformance
DMARC
Domain-based Authentication, Reporting, and Conformance
Questions?