Methodology / dmarc

DMARC

What is checked: a TXT record at _dmarc.<mail domain> with p=quarantine or p=reject, applied to all mail (RFC 7489).

Why it matters: DMARC tells receiving mail servers what to do with mail that claims to be from you but fails SPF and DKIM. With p=none, spoofed mail is still delivered. This is the protection behind "a fake email from the Gemeinde".

Smallest fix, in three steps over a few weeks:

1. Start monitoring: v=DMARC1; p=none; rua=mailto:dmarc-reports@example-gemeinde.ch.
2. Read the reports (or let your provider), and fix SPF/DKIM for every legitimate sender.
3. Enforce: v=DMARC1; p=quarantine; rua=mailto:..., then p=reject when nothing legitimate is caught.

p= must come directly after v=DMARC1. Publish one record only.