DMARC Explained
Last updated by Stuart Larsen on
Domain-based Message Authentication, Reporting, and Conformance is an email security protocol that helps domain owners protect against email spoofing and impersonation attacks on their email domains.
DMARC has two main goals:
- Policy: specify how to handle unauthenticated emails
- Reporting: give insights into the status of email authentication
Why DMARC?
Without DMARC, mailbox providers (Google, Yahoo!, etc) will sometimes accept unauthenticated spoofed emails claiming to be from your domain. DMARC allows domain owners to specify that emails without authentication from their domain should be rejected/quarantined.
DMARC Policy
DMARC records are published in DNS as TXT records under the name
_dmarc.yourdomain.com.v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com
Example of a DMARC record with a "reject" policy and an email address for receiving reports.
The above is a typical DMARC record. It specifies that the domain owner wants to reject unauthenticated email and receive aggregation reports (rua=).
The possible policy (p=) values are:
- none: No action should be taken on unauthenticated email
- quarantine: Emails should be marked as 'suspicious'. Usually this means emails will be sent to spam
- reject: Reject unauthenticated emails
Enforcement can block legitimate email
Before using a quarantine or reject policy, make sure every legitimate email source is correctly configured for SPF or DKIM. Messages from an unconfigured source can fail DMARC and be sent to spam or rejected.
Authentication
- Sender Policy Framework: The email must be sent from an IP address authorized in the domain's SPF record. It matches against the
Return-Pathdomain (not the visibleFromdomain) - DomainKeys Identified Mail: The email must be cryptographically signed with the key in the domain's DKIM record. It matches against the DKIM signature's
d=domain.
If one of those checks passes, and the domain used in the checks is aligned with the from domain, then the email is considered DMARC authenticated.
Alignment
DMARC also ensures that the domains authenticated in SPF (
Return-Path) and DKIM (signature d= domain) align with the visible From address domain. Alignment can be relaxed or strict (specified by aspf=r/adkim=r or aspf=s/adkim=s in the policy), defaulting to relaxed. In
relaxed mode, the organizational domains must match. In strict mode, they must exactly match.Reporting
Reporting gives domain owners insight into the current status of their email authentication. When the
rua tag is present, emails will be sent roughly every 24 hours to the specified address with information on the IP addresses that are sending emails, and if they passed SPF/DKIM/DMARC. Reporting is completely free and recommended for all domain owners. To enable, put an email address (with the mailto: scheme), and XML reports may be delivered every 24 hours from each mailbox provider that receives emails from your domain. If the report email address is not part of the same organizational domain, you need to enable External Report Receiver.
You can still use reporting even when your DMARC policy is
p=none. This is an amazing tool for deploying DMARC. Emails will still be delivered, but reporting let you know who is sending emails with your domain along with their current SPF/DKIM status. You can then tune your services and ensure everything is working correctly before upgrading your DMARC policy to p=quarantine or p=reject.