Skip to main content
日本語 简体中文 繁體中文

[Email DLP] What to Do When "Not Activated" is Displayed in DMARC Status?

Question

When checking the DMARC Coverage status to confirm our company's DMARC status, it displayed "Not Activated".
What actions should be taken to comply with DMARC?

Answer

There are several possible reasons why "Not Activated" is displayed in the DMARC Coverage status.
Please check the following solutions in order.
※ If you want to prevent misuse of domains that do not send emails, please refer to the following procedure.
Sending Domain Authentication for Domains That Do Not Send Emails

"Not Activated" is displayed in the DMARC section+

  1. There is an error in the DMARC record description

    Please refer to the following article for the description of DMARC records.
     Publish DMARC Record

"Not Activated" is displayed in the DKIM section+

  1. DKIM test mode remains enabled

    If the following message is displayed, DKIM is in test mode.
    Please check the TXT records configured on your DNS server and remove "t=y" from the DKIM value. *No action is required within Email DLP. (The TXT record displayed on Email DLP is a sample record.)

    Currently in test mode. Please remove "t=y" from the target TXT record to enable it

  2. There is an error in the DKIM record description

    Please refer to the following article for the method of describing DKIM records.
     [Email DLP] Tenant Settings - DKIM Configuration

"Not Activated" is displayed in the SPF section+

  1. There is an error in the SPF record description (SPF record for Email DLP is not registered)

    Please refer to the following article for the method of describing SPF records.
     Add SPF Record

  2. DNS record lookup count exceeds 10 times
    Mechanisms involving DNS record lookups (such as include:) and modifiers are limited to a maximum of 10 times.
    Additionally, if the reference destination is further referenced, it will be counted additionally, so be careful about changes to the reference destination.
    [Reference] Site to check the number of lookups: https://dmarcian.com/spf-survey/ (external link)

Settings for Domains That Do Not Send Emails+

For domains that do not send emails, you can prevent old or unused domains from being misused for spoofing emails by setting all emails to be rejected.

  1. Register the following record in the SPF record.

    v=spf1 -all

  2. Register the following record in the DMARC record.

    v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s;