HowyGuard

How do I set up email filtering and DMARC?

Howy the walrus dropping a suspicious envelope in the bin

Google Workspace and Microsoft 365 already filter email for spam and malware. Turn on their extra protections: Gmail's Safety settings, or Microsoft's Standard preset policy. Then set up SPF, DKIM and DMARC on your domain so nobody can easily send email as you. Save dated screenshots of each.

Email filtering scans incoming mail for harmful links and attachments. DMARC stops other people sending email that looks like it's from you.

Check if you already have it

  • Filtering on Google Workspace: in admin.google.com, go to Apps, Google Workspace, Gmail, Safety. Every protection under Attachments, Links and Spoofing should be ticked.
  • Filtering on Microsoft 365: in security.microsoft.com, open Preset security policies. Standard protection should be on for all recipients.
  • DMARC: run the free email check on HowyGuard with your domain. SPF, DKIM and DMARC should all pass.

How to set it up

Email filtering on Google Workspace:

Strengthen Gmail's scanning for harmful links and attachments

Google Workspace, needs your Google Workspace admin sign-in

  1. Gmail already scans every message for spam, phishing and malware. These steps turn on the extra protections too.
  2. Sign in at admin.google.com with your admin account.
  3. Go to Apps, then Google Workspace, then Gmail, then Safety.
  4. Open Attachments and tick every protection. Tick Apply future recommended settings automatically, then Save.
  5. Do the same in Links and external images and in Spoofing and authentication.

How to show it's true: Screenshot each Safety section showing the protections ticked, with the date.

If you get stuck:
  • You only see your own Gmail settings, not Safety: you're in Gmail, not the Admin console. Go to admin.google.com.

Email filtering on Microsoft 365:

Turn on Microsoft's standard email protection

Microsoft 365, needs a Microsoft 365 Global Administrator or Security Administrator sign-in

  1. Microsoft 365 already scans email for spam and malware. These steps turn on Microsoft's recommended set of protections.
  2. Sign in at security.microsoft.com with an admin account.
  3. Go to Email & collaboration, then Policies & rules, then Threat policies, then Preset security policies.
  4. Under Standard protection, click Manage protection settings.
  5. Choose to apply it to All recipients, click through the steps, and click Confirm.

How to show it's true: Screenshot the Preset security policies page showing Standard protection on, with the date.

If you get stuck:
  • You get a permissions message: your account needs the Global Administrator or Security Administrator role.

For DMARC, follow DMARC for Google Workspace or DMARC for Microsoft 365. Using another email provider? Here are the general steps:

Set up SPF, DKIM and DMARC for your email

Any setup, needs your email provider's admin settings and your domain's DNS settings

  1. If you use a personal Gmail or Outlook.com address, these settings belong to Google or Microsoft, not you. The fix is moving to an address on your own domain.
  2. Otherwise, sign in where your domain's DNS settings live and look for DNS or Manage DNS.
  3. SPF: add a TXT record with the name @. Your email provider's help pages give the exact value; search for your provider's name and "SPF record".
  4. DKIM: in your email provider's admin settings, look for DKIM or email authentication, turn it on, and add the records it gives you to your DNS.
  5. DMARC: add a TXT record with the name _dmarc and this value, using an inbox you read: v=DMARC1; p=none; rua=mailto:you@yourbusiness.ca
  6. Leave it on p=none at first. Once the DMARC reports show your real email arriving normally, change p=none to p=quarantine.

How to show it's true: Run the free email check on howyguard.com and screenshot the result showing all three passing.

If you get stuck:
  • You can't find DNS settings: your website company may manage them. Ask them, or a tech.

How to show it's done

Keep dated screenshots of the Safety settings or the Preset security policies page, and of the email check showing all three records passing. File them in your proof folder.

Common questions

My form asks for the filtering product's name. What do I write?

The one you use. On Google Workspace, that's Google Workspace (Gmail) built-in protection. On Microsoft 365, it's Microsoft Exchange Online Protection, plus Microsoft Defender for Office 365 if your plan includes it.

My form asks for my Microsoft Secure Score. Where is it?

An admin can find it at security.microsoft.com/securescore. Write down the number shown.

Can I set up DMARC on a personal Gmail or Outlook.com address?

No. Those domains belong to Google and Microsoft. You need an address on your own domain.

Sources

  1. Google Workspace Admin Help: Advanced phishing and malware protectionsupport.google.com
  2. Microsoft Learn: Preset security policieslearn.microsoft.com
  3. Google Workspace Admin Help: Set up DMARCsupport.google.com
  4. Canadian Centre for Cyber Security: Implementation guidance for email domain protection (ITSP.40.065)cyber.gc.ca

Related