Amazon Workmail: how to drop or move incoming emails that failed DMARC verdict to the junk folder?

Question

I have enabled DMARC enforcement in Amazon Workmail, and I can see some emails have the Authentication-Results "dmarc=fail" in the email header, but these emails still end up in my inbox.

I can also see these email logs from CloudWatch Logs Insights with the following query:

> fields @timestamp, @message, @logStream, @log
| sort @timestamp desc
| filter event.dmarcVerdict == "FAIL"

How can I drop these emails or move them into the junk folder?

Answer

Hi,

To enforce an action on message that fail the checks for DMARC, the domain owner needs to set instructions on what to do with that mail. If there is no DMARC domain record the message will be delivered to the inbox.

You can leverage Mail flow rules to check messages inflight and reroute to junk when the message had DMARC failed headers.

Kind regards,
Robin

Amazon Workmail: how to drop or move incoming emails that failed DMARC verdict to the junk folder?

Relevant content