This guide presents the Global Security tool, which allows you to verify that the relationships between a domain name and an Infomaniak Mail Service are optimal in terms of security. This involves checking the SPF / DKIM / DMARC records, and the Global Security tool allows you to adjust the configuration if necessary.

Accessing the Global Security diagnostic tool

To access Global Security:

1. Click here to access the management of your Mail Service in the Infomaniak Manager (need help?).
2. Click directly on the name assigned to the Mail Service in question:
   
3. Click on Global Security in the left-hand menu:
   

Check that the email service is working correctly

Once you are on the Global Security page, review and check the 3 security mechanisms inherent to emails: SPF, DKIM, and the DMARC policy. These settings should be displayed in green:

Click on Edit or Create to configure SPF, DKIM, and DMARC according to the recommendations below to secure your Mail Service against potential identity theft:

SPF (Sender Policy Framework)

SPF (click here to configure) allows the owner of a domain name to specify which servers are authorized to send emails on behalf of that domain. This helps reduce the risk of spam and phishing, as the recipient's email server can verify whether the sender is authorized by consulting the DNS records of the sending domain:

Under these conditions, and if a problem is detected, you will find a Fix button that will allow you to automatically update your SPF record.

If fixing one or the other of the issues mentioned is not possible, it means that the fix must be made to the configuration set up by the owner or technician of the sender's domain name.

If your domain name points to Wix or another provider, the SPF record must be configured with the provider in question.

DKIM (Domain Keys Identified Mail)

DKIM (click here to configure) is a protocol that allows you to sign emails when they are sent.

When your domain name (or its DNS zone) is managed elsewhere, you will find the DKIM record to be added to the DNS zone in this section: Global Security > DKIM

You can configure multiple DKIM records on your domain without any limit, unlike DMARC or SPF, which is crucial if you use multiple third-party email providers for your daily communications.

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

DMARC (click here to configure) allows you to specify to other email servers (the email providers of the contacts to whom you send emails) the policy to follow in the event of receiving a "suspicious" email (not authenticated, for example) from your email server (hosted by Infomaniak). In addition, you can be notified of the "incident" by a summary message (called a "DMARC report") providing information on the recent activity of your email related to the domain name.

DMARC requires a valid SPF and DKIM. An assistant guides you through configuring DMARC according to Infomaniak's recommendations, either in simple mode or entirely to your liking in advanced mode (this expert mode allows you to enter the record of your choice):
The corresponding entries (TXT type) will then be automatically applied to the DNS zone of the domain in question (if administratively possible - for example, if the domain is managed within the same Organization).

To check the records in your DNS, you can also use an external and free service like the one mentioned at the bottom of this other guide.

Refer to this other guide if you are looking for information on the fourth item on the Global Security page.