While researching how to implement DMARC, you’ve probably seen the acronyms of RUF and RUA, but didn’t get too great an explanation of how exactly they work, right? Well, we’ve got a quick read that covers the basics on what they are, what they provide and how they help you stay secure.
RUF and RUA sound like the names of a pair of barky dogs, and they kind of are (perhaps this was intentional from the designers?!). Dogs bark to alert you to problems, right? That’s exactly what RUF and RUA are for, with each one providing different kinds of alerts to help with your email security.
RUF/RUA reports need to be sent somewhere to be read later and that ‘somewhere’ is going to be an email address! Both report-types should receive their own dedicated mailbox (do not use your own email administrator mailbox unless you want to never see other emails again, which hey, maybe some of you don’t; we get it) which will need at least an occasional logging into to parse through the data and take action upon the reports.
Our general recommendation is to review these mailboxes at least weekly while in the DMARC setup process, then about quarterly after DMARC is fully enforced.
If using Tangent’s DMARC Director service, we’ll provide specialty mailboxes for you that will automatically read the reports and provide visualizations of the data for you, on top of us interpreting them and letting you know of any steps you should take.
Great, you’ve got email addresses and nice meaty mailboxes set up to receive the RUF/RUA reports. Now how do I tell receiving mail servers to send records-of-failure to them?
You guessed it! It’s our ever-present friend: the Samwise Gamgee of the internet, the humble DNS record.
Create DNS Records: Add the email addresses to the DMARC policy in your DNS, specifying different addresses for the RUA and RUF (sample entry below; do not use):
"v=DMARC1; p=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1"
Monitor and Adjust: Regularly check your inboxes (quarterly is great), parse through the reports, and adjust your SPF, DKIM and DMARC settings accordingly. This is the final step of configuring RUF/RUA and the only real “ongoing” one.
Be aware that the quantity of reports that are generated, particularly by RUF, can be pretty darn intimidating. If you find yourself wanting assistance on parsing these reports and letting you know what you should do, Tangent can help.
Interpreting DMARC RUF and RUA reports are like a bit like swimming a marathon in a sea of XML — daunting but ultimately rewarding when you emerge victorious. RUF and RUA are both here to help you, though they might come with a steep learning curve.
With that all said, feel like you’ve got a good handle on RUA/RUF but want a second opinion? Want to go deeper into the reports with more technical information? Or maybe you want an automated service to interpret these reports for you into straightforward visualizations and quickly actionable steps?
For any or all of the above, let us know. We’ve got all the solutions available.