--- title: "Enforcing DMARC policies on incoming emails in Amazon WorkMail | DuoCircle" description: "Enforcing DMARC policies on incoming emails in Amazon WorkMail." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/dmarc/enforcing-dmarc-policies-on-incoming-emails-in-amazon-workmail/" --- Quick Answer Amazon WorkMail can enforce DMARC on incoming messages; new WorkMail organizations have it on by default. To enable enforcement: open the WorkMail console at console.aws.amazon.com/workmail, select the right AWS Region, choose Organizations > your organization > Organization settings, open the DMARC tab, click Edit, slide DMARC enforcement to ON, acknowledge that some inbound mail may be dropped or quarantined based on the sender's domain configuration, and Save. To disable, repeat and slide to OFF. Because misconfigured sender domains can cause legitimate mail to be filtered, enable email event logging in WorkMail to monitor DMARC results. To inspect: open CloudWatch Insights, go to Logs > Insights, select the WorkMail log group (e.g., /aws/workmail/events/organization-alias), choose a time window, and run the query 'stats count() by event.dmarcPolicy | filter event.dmarcVerdict == "FAIL"' to see DMARC failures by policy. Enforcing DMARC policies on incoming emails in Amazon WorkMail Your browser does not support the audio element. [ Download episode](https://media.mailhop.org/duocircle/images/2024/11/Enforcing-DMARC-policies-on-incoming-emails-in-Amazon-WorkMail.mp3) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fdmarc%2Fenforcing-dmarc-policies-on-incoming-emails-in-amazon-workmail%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Enforcing%20DMARC%20policies%20on%20incoming%20emails%20in%20Amazon%20WorkMail&url=undefined%2Fblog%2Fdmarc%2Fenforcing-dmarc-policies-on-incoming-emails-in-amazon-workmail%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fdmarc%2Fenforcing-dmarc-policies-on-incoming-emails-in-amazon-workmail%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fdmarc%2Fenforcing-dmarc-policies-on-incoming-emails-in-amazon-workmail%2F&title=Enforcing%20DMARC%20policies%20on%20incoming%20emails%20in%20Amazon%20WorkMail "Share on Reddit") [ ](mailto:?subject=Enforcing%20DMARC%20policies%20on%20incoming%20emails%20in%20Amazon%20WorkMail&body=Check out this article: undefined%2Fblog%2Fdmarc%2Fenforcing-dmarc-policies-on-incoming-emails-in-amazon-workmail%2F "Share via Email") ![Emails In Amazon WorkMail](https://media.mailhop.org/duocircle/images/2024/11/office-365-migration-service-6185.jpg) Email domains use DNS to secure communications from eavesdroppers. They aim at preventing [phishing, spoofing](https://thehackernews.com/2024/07/proofpoint-email-routing-flaw-exploited.html), ransomware, and [impersonation attacks](https://www.bleepingcomputer.com/news/security/us-sec-warns-investors-of-ongoing-govt-impersonation-attacks/). [DNS records](https://www.ibm.com/topics/dns-records) also include a DMARC record, which is implemented and configured by the owner of the specific domain with the intention of allowing only **authorized entities** to send emails from that domain. A [DMARC record](/resources/create-dmarc-records) consists of DMARC policies that instruct the receiving server on how to deal with unauthorized emails sent from your domain. _By unauthorized emails, we mean outgoing emails from your domain that didn’t pass the DMARC checks_. New Amazon WorkMail organizations have **DMARC enforcement** turned on by default. Here’s how you can enable DMARC enforcement- 1. Open the Amazon WorkMail console at . 2. If needed, select a different AWS Region by opening the **Region selection list** at the top of the console, and choose your desired Region. For further guidance, see ‘Regions and endpoints’ in the [Amazon Web Services](https://www.techtarget.com/searchaws/definition/Amazon-Web-Services) General Reference. 3. _In the navigation pane, select ‘Organizations,’ then click on your organization’s name_. 4. Go to ‘Organization settings’ in the navigation pane. The **Organization settings page** will open, showing several tabs. 5. Select the ‘DMARC’ tab and click ‘Edit.’ 6. Switch the ‘DMARC enforcement’ slider to the **ON** position. 7. Check the box acknowledging that enabling DMARC enforcement may lead to inbound emails being dropped or quarantined based on the sender’s domain configuration. 8. Click ‘Save.’ To disable DMARC enforcement: [![sender’s domain configuration](https://media.mailhop.org/duocircle/images/2024/11/dmarc-report-2.jpg)](https://media.mailhop.org/duocircle/images/2024/11/dmarc-report-2.jpg) Repeat the steps above, but switch the DMARC enforcement slider to the **OFF** position. ## Using email event logging to track DMARC enforcement Here’s a clearer version of the instructions: _Enabling DMARC enforcement may cause some inbound emails to be blocked or marked as spam, depending on the sender’s domain configuration_. If a sender’s domain is misconfigured, [legitimate emails](https://www.trendmicro.com/vinfo/us/security/definition/legitimate-bulk-emails) might be blocked. To monitor for such issues, enable email event logging in Amazon WorkMail. This allows you to query email logs to see if **emails are being filtered** out due to [DMARC policies](/dmarc/a-guide-to-advancing-dmarc-policies-for-enhanced-email-deliverability/). Steps to Track [DMARC](/resources/what-is-dmarc) Enforcement with Email Event Logging 1. ‘Enable email event logging’ in the **Amazon WorkMail console** and let it run for some time to collect data. 2. Open the ‘CloudWatch Insights console’ and go to ‘Logs > Insights.’ 3. Under ‘Select log group(s)’ choose your Amazon WorkMail log group (e.g., \`/aws/workmail/events/organization-alias\`). 4. _Select a time period to review_. 5. Run the following query to find emails affected by DMARC: _stats count() by event.dmarcPolicy | filter event.dmarcVerdict == “FAIL”_ 6. Click ‘Run query’ to view the results. [![email authentication](https://media.mailhop.org/duocircle/images/2024/11/SPF-record-checker-7126.jpg)](https://media.mailhop.org/duocircle/images/2024/11/SPF-record-checker-7126.jpg) ## Final words DMARC has proven to be a game changer in this era where [email-based cybercrimes](https://www.infosecurity-magazine.com/news/critical-infrastructure-email/) are at their peak. We at [DuoCircle](/) help and guide you with [email authentication](/resources/email-authentication) so that cyber attackers don’t exploit your **business and domain name**. [Book a demo](/demo-request) with us. ## Topics DMARCUpdates ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) ## Related Articles [ DMARC 5m A Guide to Advancing DMARC Policies for Enhanced Email Deliverability Jan 19, 2024 ](/blog/dmarc/a-guide-to-advancing-dmarc-policies-for-enhanced-email-deliverability/)[ DMARC 5m How to check DMARC compliance for any domain Jun 25, 2024 ](/blog/dmarc/a-guide-to-checking-dmarc-compliance/)[ DMARC 6m A guide to detecting DMARC problems using the pentesting techniques Oct 3, 2024 ](/blog/dmarc/a-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques/)[ DMARC 8m How to publish a DMARC record for your domain (with example) Jun 12, 2024 ](/blog/dmarc/a-guide-to-publishing-dmarc-records-for-your-domain/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"Enforcing DMARC policies on incoming emails in Amazon WorkMail","description":"Enforcing DMARC policies on incoming emails in Amazon WorkMail.","url":"https://www.duocircle.com/blog/dmarc/enforcing-dmarc-policies-on-incoming-emails-in-amazon-workmail/","datePublished":"2024-11-15T15:59:38.000Z","dateModified":"2025-08-20T17:54:34.000Z","dateCreated":"2024-11-15T15:59:38.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/dmarc/enforcing-dmarc-policies-on-incoming-emails-in-amazon-workmail/"},"articleSection":"dmarc","keywords":"DMARC, Updates","wordCount":461,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/11/office-365-migration-service-6185.jpg","caption":"Emails In Amazon WorkMail","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"DMARC"},{"@type":"ListItem","position":3,"name":"Enforcing DMARC policies on incoming emails in Amazon WorkMail","item":"https://www.duocircle.com/blog/dmarc/enforcing-dmarc-policies-on-incoming-emails-in-amazon-workmail/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"DMARC","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Enforcing DMARC policies on incoming emails in Amazon WorkMail","item":"https://www.duocircle.com/blog/dmarc/enforcing-dmarc-policies-on-incoming-emails-in-amazon-workmail/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Enforcing DMARC policies on incoming emails in Amazon WorkMail","description":"Enforcing DMARC policies on incoming emails in Amazon WorkMail.","url":"https://www.duocircle.com/blog/dmarc/enforcing-dmarc-policies-on-incoming-emails-in-amazon-workmail/","datePublished":"2024-11-15T15:59:38.000Z","dateModified":"2025-08-20T17:54:34.000Z","dateCreated":"2024-11-15T15:59:38.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/dmarc/enforcing-dmarc-policies-on-incoming-emails-in-amazon-workmail/"},"articleSection":"dmarc","keywords":"DMARC, Updates","wordCount":461,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/11/office-365-migration-service-6185.jpg","caption":"Emails In Amazon WorkMail","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```