OnDMARC simplifies the complexities of SPF for an international exchange company

This case study looks at a non-profit organization specializing in the administration of exchange visitor programs on behalf of the U.S. Government. For more than 50 years they have been responsible for facilitating exchange programs between the U.S. and over 60 countries requiring them to send over 3 million emails each year.

With only a basic DMARC reporting tool at the time, the organization knew they were exceeding the SPF lookup limit and that their SPF alignment required attention, but the tool offered no guidance on how to resolve it. With multiple services across the organization sending email on their behalf, the challenge was to identify and secure every sender:

1. Discovery: The Chief Technology Officer (CTO) explained, “Unlike other DMARC reporting tools, OnDMARC offered an intuitive interface with clear insight into what is aligned or not aligned for SPF for each service using our domain. This kept us on track and allowed us to get the job done effectively.”
2. Validation: The team was able to verify configurations instantly—without waiting 24 hours for DNS changes to propagate—thanks to Investigate. As the CTO noted, “This tool was fundamental. We used Investigate as proof to heads of department that we could safely implement DMARC and SPF without blocking any legitimate business emails.”
3. Ongoing protection: After securing their domain with OnDMARC, a 30-day report showed that of the 566,395 emails sent from their domain, 68% were fake. The CTO acknowledged that “due to the nature of what we do, we’re a high-risk industry for phishing scams,” but reports confirmed that all unauthorized emails were successfully blocked from delivery.

SPF lookups are a common obstacle for IT teams, as the DNS lookup limit is capped at 10. This limit exists to reduce the potential for highly amplified Denial of Service (DoS) attacks against the Internet’s DNS infrastructure. Each email service adds one or more lookups—Gmail alone, for example, adds three.

After an email marketing platform was added to the organization’s services, the CTO noted, “we couldn’t handle the number of SPF entries on our stock integration for all of our email sources,” reinforcing the need for a more capable solution.

It quickly became clear that “we had no guidance on what to do from the weekly digests our previous DMARC reporting tool gave us. It was only when searching for a solution that we discovered Dynamic SPF. This tool, along with OnDMARC’s ongoing guidance, helped us overcome our technical IP limitations and move the project forward by managing all lookups from inside our account.” Once using OnDMARC, the team was able to get to work quickly, simplifying the management of their 20+ entries within the first three days of setting up their account.