Blog
Notes from the CloudPandas team
Practical guidance on Microsoft 365, Azure, Intune, Entra ID, security, and modern communications.
SecurityDMARCDKIM: Who Signed This Message?
DKIM signs the message itself, and the signature survives every hop that changes nothing. Whoever signed it is not necessarily the sender. Why Microsoft 365 needs two rotations to reach 2048 bits, and why a properly signed message can still be phishing.
Martin Sende·
SecurityMicrosoft 365DMARCSPF: Who Gets to Speak in Your Name?
SPF answers a single question: is this server allowed to hand over mail on behalf of this domain? Why the ten-lookup limit exists, where the lookups go in real-world records, why SPF breaks on forwarding, and why an SPF pass without alignment counts for nothing under DMARC.
Martin Sende·
SecuritySecurityDMARCNIS2 and DMARC: Why No Law Tells You What to Do
NIS2 never mentions DMARC. For many companies there is still no way around it. The path from the law to the actual technology runs through the state of the art and Germany's BSI technical guidelines. With legal context from Raphael Köllner.
Martin Sende·
SecurityComplianceIntuneCompany Portal usage data: the one toggle you cannot configure
Company Portal telemetry is enabled by default with no official admin switch. We dive deep into the UWP settings hive to show you where the toggle lives and how to manage it.
Artem Brening·
SecurityMigrationMicrosoft 365Passkeys become the default in Entra ID – what to do before September 1
With Microsoft phasing out SMS and voice MFA in Entra ID, passkeys are becoming the new default. Here is how to prepare your organization before the deadlines.
Artem Brening·
SecurityMicrosoft 365ExchangeFull Participation: Why a DMARC Standard Doesn't Mean p=reject for Everyone
DMARC is now an IETF standard, RFC 9989. But a standard is not a mandate, and full participation does not mean p=reject. What DMARCbis actually requires, and why the standard even bars receivers from blindly enforcing p=reject.
Martin Sende·
SecurityDMARCSecurityDMARCbis: The DNS Tree Walk and Why np Doesn't Always Fire on DNSSEC Domains
DMARCbis replaces the Public Suffix List with a DNS Tree Walk. What the psd tag actually does, and why np can silently fail on DNSSEC domains that use Compact Denial of Existence.
Martin Sende·
SecurityDMARCMicrosoft 365DMARCbis: The tag changes and why t doesn't replace pct
DMARCbis cleans up the DMARC tags: pct, rf, and ri are dropped, while np and t are added. It sounds like routine, but it isn't everywhere. Why t does not replace pct and what this means for the path to full enforcement.
Martin Sende·
SecurityMicrosoft 365DMARCDMARCbis is here. What is changing. And what is not.
The new DMARCbis standard is here: Learn what is changing with email authentication, why your existing record will continue to work, and which DNS details are now important.
Martin Sende·