Check Point Email Security DMARC Management

What the DMARC Management add-on is

Check Point Email Security, formerly called Harmony Email & Collaboration, is what Check Point's guide calls an API-based inline protection service. The guide says it provides DMARC Management as an add-on (opens in a new tab) that "helps organizations make sure all legitimate senders are allowed so that you can confidently apply a restrictive policy tag". The add-on includes three parts: DMARC, SPF Management and DKIM (opens in a new tab) Management.

The guide lists three main benefits (DMARC introduction (opens in a new tab)):

• Visibility of all the services sending email on behalf of your domains and subdomains
• Search across all DMARC failed emails sent on your organisation's behalf
• Actionable DMARC record change recommendations

Check Point's product page (opens in a new tab) adds managing authorised sending sources and a dedicated reporting mailbox hosted by Check Point. Our sister site covers the add-on as part of the wider Check Point suite on its Check Point DMARC Management (opens in a new tab) page.

How reports are collected

The add-on needs your aggregate (rua) reports. You can send them to a protected internal mailbox, or to the hosted mailbox Check Point creates for every tenant (hosted RUA mailbox (opens in a new tab)). Check Point says large senders receive so many reports that Microsoft and Google often reject some of them, which is why it hosts one. Setting it up:

1. In the portal, go to DMARC > Overview > Configuration
2. Copy the address in the "Your Hosted reports mailbox" field
3. Add it to the rua tag of each domain's DMARC record, alongside any existing address; Check Point notes DNS changes might take up to 24 hours to show
4. Check Point then adds an external reporting authorisation record (opens in a new tab) at your-domain._report._dmarc.dmarc-cp.com (a TXT record of v=DMARC1), so receivers agree to send reports to it

Other details from the guide:

• Virtual RUF reports: many providers do not send failure reports, so when a DMARC-failing message passes through the Email Security network, Check Point generates a virtual RUF report (opens in a new tab); there is an opt-out
• Domain discovery: the add-on can discover domains from your reports (opens in a new tab), switched on by default, or you can add a domain manually (opens in a new tab), which may take up to 24 hours to start
• Retention: RUF and RUA reports are stored for 60 days (opens in a new tab), and IPv4 and IPv6 are both supported

Dashboards, recommendations and the change log

The DMARC Overview page lists every domain with these columns (reviewing DMARC status (opens in a new tab)):

You can export up to 50,000 entries at a time to CSV and group domains by top-level domain. Widgets (opens in a new tab) show top domains by success and failure and top sending domains, and separate SPF and DKIM pages show SPF and DKIM success per domain. Clicking a failing sending source shows a summary of its failure reasons and a recommended fix (opens in a new tab).

The Recommendations (opens in a new tab) page suggests changes such as adding IP addresses to SPF, configuring rua mailboxes properly, adding a policy where p=none and moving to a restrictive policy, which Check Point suggests once DMARC failures are below 3%. The DNS Change-Log (opens in a new tab) records every change to SPF records and DMARC policies, with previous and new values, and is kept for 7 years; Check Point says SPF records are synchronised every hour.

SPF Management, DKIM Management and alerts

SPF Management (opens in a new tab) is included in the add-on. You either add Check Point's include to your SPF record or replace the record with one in this form, where the code is shown in the portal's Instructions widget:

v=spf1 include:(your code).spf.checkpoint-spf.com ~all

Check Point says it uses the SPF macro mechanism, "which allows an unlimited number of SPF entries to be defined", so you avoid the 10 DNS lookup limit (opens in a new tab). It became generally available (opens in a new tab) for all DMARC Management customers in December 2024.

DKIM Management (opens in a new tab) is also included. You add your selectors in the portal, then delegate the domain's DKIM records with an NS record, after which Check Point manages the selectors so you no longer update DKIM in DNS each time. Check Point's announcement (opens in a new tab) says you can create, rotate and manage DKIM keys from the admin portal; it is activated from the Add-On Store with Request Activation.

Alerts (opens in a new tab) can be set on DMARC, SPF and domain activity. Check Point's alerts announcement (opens in a new tab) lists five conditions:

• Error in SPF record
• Error in DMARC record
• Drop in daily DMARC success rate
• DMARC reports stopped being received
• Detection of a new failing source

Each alert can send an email and raise a security event, and Check Point says those events can be forwarded to SIEM platforms and read through APIs.

Check Point's policy guidance under RFC 9989

Check Point's guide has been updated for RFC 9989 (opens in a new tab), the DMARC standard published in May 2026. It says p=reject is no longer the recommended default final state for every domain (opens in a new tab), and recommends end states by domain type:

It also suggests separating human mailbox domains from transactional sending subdomains, and says domains already at p=reject should not be rolled back automatically: review the aggregate reports and move back to quarantine only if legitimate mail is disrupted. The NCSC, for its part, still describes reject on all domains (opens in a new tab) as the best way to prevent spoofing, so the right end state depends on each domain. Our DMARC policy guide sets out both views.

Licensing, trial and set-up

Check Point Email Security comes in two coverage options (Email Only, or Email and Collaboration) and two security levels (Advanced Protect, or Complete Protect, which adds DLP). The licensing guide (opens in a new tab) says that, whichever package you choose, you can add DMARC Management, described as supporting "the maintenance of a restrictive DMARC policy". It is licensed per user, confirmed at quote, and Check Point's plans page (opens in a new tab) shows no public prices: ask us for a quote. A new Email Security account comes with a 14-day free trial of all features for an unlimited number of users (licensing guide (opens in a new tab)).

A typical set-up:

1. License the DMARC Management add-on on your Email Security tenant (Add-On Store > Request Activation)
2. Point each domain's rua tag at the hosted mailbox or a protected internal mailbox
3. Let domains be discovered from the reports, or add them manually
4. Work through the Overview, Recommendations and failing sources, fixing SPF and DKIM for each legitimate sender
5. Optionally switch on SPF Management and DKIM Management
6. Move each domain to the enforced policy that suits it, and set up alerts

How we help with Check Point DMARC Management

We supply Check Point Email Security and its add-ons, so DMARC Management can be quoted with your email protection. We can:

• Assess your domains: check your current DMARC, SPF and DKIM records with our DMARC checker and list every domain you own
• Quote the add-on: as part of a new Email Security package or on an existing tenant, licensed per user
• Set up reporting: point each domain at the hosted reporting mailbox and confirm reports arrive
• Move you to enforcement: use the recommendations and per-source guidance to fix each sender, then choose quarantine or reject per domain

Not using Check Point Email Security? EasyDMARC and Valimail are standalone DMARC platforms we also supply. Contact us for free advice or a quote.