Getting Started

Your Barracuda Networks login can be connected to Microsoft 365. If you are connected to a Microsoft 365 account, your domains will already be pre-loaded on the Domain Fraud Protection (DFP) page when you begin. (They will still need to be verified, however.) If you log into Domain Fraud Protection without a Microsoft 365 account, domains can be entered manually.

Login for the first time using one of the options below. Then configure Domain Fraud Protection.

Option 1 – Logging in to Barracuda Networks without Connecting a Microsoft 365 Account

1. Go to https://login.barracudanetworks.com
   • If you do not already have a Barracuda account – Enter your email, create a password, and click Get Started. Provide information for your account and click Get Started. 
   • If you have a Barracuda account – Enter your email and password and click Sign In. 
2. On the left navigation menu, select Domain Fraud Protection. (You must have a subscription to Barracuda Domain Fraud Protection or the Barracuda Email Protection Premium or Premium Plus plan.)

Option 2 – Logging in for the First Time and Connecting Your Microsoft 365 Account

Complete the following steps:

1. Navigate to https://login.barracudanetworks.com. 
   • If you do not already have a Barracuda account – Enter your email, create a password, and click Get Started. Provide information for your account and click Get Started. 
   • If you have a Barracuda account – Enter your email and password and click Sign In. 

   Note that for your first login, Barracuda Networks requires a linking code, but does not require a serial number. 

2. Click Connect to Microsoft 365. Optionally read about the permissions needed. 
   

3. When Microsoft 365 opens, log in as a global tenant administrator. 

4. Review the permissions required by Barracuda and click Accept.

5. On the left navigation menu, select Domain Fraud Protection.

Configuring Domain Fraud Protection with Barracuda

Domain Fraud Protection makes use of the Domain-based Message Authentication, Reporting and Conformance (DMARC) authentication protocol, which is an email-validation system designed to detect and prevent email spoofing. It can be used to defend against certain types of email attacks, including phishing and email spam. In these types of attacks, the email sender's address is forged, but the email itself appears to be legitimate. DMARC attempts to counter the illegitimate usage of the exact domain name in the From: field of email message headers. If you have DMARC enabled and other organizations are recognizing DMARC, then your domain cannot be spoofed in phishing attempts, thereby protecting the reputation of your domain.

A DMARC policy allows a sender's domain to indicate that their emails are protected by Sender Policy Framework (SPF), Domain Keys Identified Mail (DKIM) or both. The DMARC policy instructs receivers as to what to do if neither of those authentication methods passes (for example, rejecting the message). DMARC makes explicit how to handle these types of failed messages. DMARC policies are published in the public Domain Name System (DNS).

To ensure the sender trusts this process, receiving mail servers send daily aggregate reports indicating how many emails have been received and if these emails passed SPF, DKIM, or both and were aligned. The sender can examine any failed IP addresses and identify the domains responsible for distributing fraudulent email. For more detailed information, see Step 2 - Working with Email Sources.

The complete process of enabling DMARC enforcement includes the following three steps: