Insecure email configuration

Domains

Email SPF Not Configured (RS3), Email Weak SPF Configured (RS4), Email DMARC Not Configured (RS7), Email Weak DMARC Configured (RS8)

Observed domain, and
- We infer domains from inboxes and aliases, however we do not infer domains from PSA integrations since there are often different contacts sometimes not associated with the company
RS3: DNS records do not include an SPF record, or
RS7: DNS records do not include a DMARC record, or
RS8: DNS record contains a valid DMARC record that contains one of:
- Empty policy or policy set to none
- Percentage less than 100%
- Subdomain policy is set to none

Update or add an SPF DNS record with a strict qualifying mechanism
- Cork prefers -all, however a soft fail ~all or pass +all is generally fine if there is a strong DMARC record also present
Update or add a DMARC DNS record that is considered strict:
- Policy (p=) is set to reject or quarantine
- Percentage (pct=) is set to 100, this specifies the percentage of emails subject to filtering
- Set the subdomain policy (sp=) to reject as well, unless you have specific DMARC records on those subdomains

Cork does not consider the strictness of SPF configuration since it can be hardened with strictly configured DMARC
- However we will raise a recommendation, but not an alert, if the SPF qualifying mechanism is not -all