The settingWhat we hold this to
CreativeTechs minimum
SPF published with a hard fail (-all) for every sending domain. DKIM enabled and signing on every accepted domain, 2048-bit. DMARC published at p=quarantine minimum, pct=100, with a rua address we monitor. Target state p=reject.
Benchmark position
CISA MS.EXO.4.2 — the DMARC message rejection option SHALL be p=reject. CIS M365 2.1.9 (L1) — DKIM enabled for all Exchange Online domains. CISA MS.EXO.2.2 — SPF published per domain.
Where we differ, and why
CISA sets the bar at p=reject; our floor is p=quarantine because moving a live agency straight to reject without reading aggregate reports first breaks legitimate senders. Reject is the target, quarantine is the minimum we will accept sitting at — and Alert Monster already holds the report history to prove when a domain is safe to move.
Where the switch is
DNS at the registrar for SPF and DMARC records. DKIM: Defender portal → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM → select domain → Enable.
How to verify
dig +short TXT <domain> # SPF, expect -all dig +short TXT _dmarc.<domain> # expect p=quarantine or p=reject, pct=100, rua= Get-DkimSigningConfig | fl Domain,Enabled
- Why it matters
- Without all three, anyone can send mail as the client's domain. The cheapest possible impersonation of someone the client already trusts, and the front half of nearly every invoice-fraud story.
- How we check
- Huntress rates all three High. Maester MT.1182, ORCA 108/235/244, CISA.MS.EXO.2.2/3.1/4.1–4.3, CIS.M365.2.1.9. Alert Monster already tracks DMARC posture per domain — that's the signal to wire in rather than rebuild.
- Fix — M365
- Publish SPF with a hard fail; enable DKIM signing for every accepted domain; publish DMARC at p=none with a rua address first, then quarantine and reject once Monster shows clean.
- Fix — Google
- Same DNS records; enable DKIM under Admin → Apps → Gmail → Authenticate email.
- User notices
- None when sequenced. Jumping straight to p=reject without reading reports breaks legitimate senders.
- Expected pushback
- None on the goal. Monster gives months of evidence to move safely, so the staged rollout is nearly free.