Platform & Services
Company
Platform & Services
Company
- Copyright © Sendmarc
- Website terms
- Privacy policy
- Terms of service
- Security
The Center for Internet Security (CIS) is a globally recognized nonprofit – started in 2000 – dedicated to enhancing cybersecurity for organizations of all sizes. CIS is best known for the CIS Controls® and CIS Benchmarks™, widely used best practices for securing IT systems. It also funds the Multi-State Information Sharing and Analysis Center ® (MS-ISAC), which provides threat intelligence, incident response and recovery guidance, and actionable insights to State, Local, Tribal, and Territorial (SLTT) government entities in the U.S..
CIS has developed practical guidance to help organizations understand Domain-based Message Authentication, Reporting, and Conformance (DMARC) implementation. DMARC is a critical email security standard that helps prevent phishing, spoofing, and other email-based attacks.
Interested in improving your business’s defense against email threats? We can help!
Email remains one of the primary attack points for cybercriminals. Phishing, Business Email Compromise (BEC), and domain spoofing continue to cause significant financial and operational damage. DMARC implementation increases the chance that only authorized email senders use a company’s domain, blocking fraudulent messages before they reach inboxes.
DMARC works with Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) to authenticate emails, allowing domain owners to specify how unauthenticated emails should be handled (monitored, quarantined, or rejected).
The CIS and MS-ISAC guidance outlines a structured approach to DMARC implementation to maximize security while ensuring uninterrupted email communication. Their best practices include:
Businesses should start with a monitoring policy (p=none) to collect reports on how their domain is being used. This step ensures that all legitimate email sources are identified and properly configured before moving to more restrictive policies.
Once email authentication mechanisms are verified and properly configured, organizations should strengthen their DMARC policy over time to better protect their domain, following these suggestions:
By gradually enforcing DMARC policies, companies can reduce the risk of blocking legitimate emails.
DMARC provides detailed reports on email authentication failures. Businesses should:
A p=reject DMARC policy provides the highest level of protection by ensuring that fraudulent emails are blocked before they ever reach recipients. According to CIS and MS-ISAC, enforcing DMARC at this level:
The CIS and MS-ISAC guidance provides a clear and actionable roadmap for effective DMARC implementation. By following their approach, organizations can strengthen their email security posture without disrupting legitimate email communications.
For businesses, government agencies, and nonprofits alike, DMARC implementation is no longer optional—it’s a cybersecurity necessity.
Learn about CIS and MS-ISAC’s recommendations in their blog.
Find out more about DMARC through one of our experts or our platform.