Why DMARC?

Last updated by Stuart Larsen on

DMARC helps you control who can send email using your domain. Without DMARC, it's possible to send emails that appear to come from your domain.
The ability to send emails from any domain is very useful for attackers/fraudsters. Two example attacks:
  • Account Takeovers: An attacker sends an email claiming to be "it@bank.com". The email says that there's been a security alert on your account and you need to sign into your account. But the link in the email goes to the attacker website where they record and steal your password.
  • Invoice Fraud: An attacker sends an email to an internal payments department claiming to be "ceo@company.com", with a message saying that we need to immediately pay a fake invoice from a fake vendor. But the invoice is routed to an attacker payment account.

How does it work?

DMARC works together with SPF and DKIM. SPF and DKIM handle the authentication, while DMARC sits on top and sets the policy.
  • SPF: Sets an allowlist of IP addresses allowed to send emails for a domain
  • DKIM: Cryptographically signs emails proving authentication
When a mailbox provider (Gmail, Yahoo!, etc), receives an email, they will check DMARC, SPF, and DKIM to help them decide if they should deliver the email to the mailbox.
DMARC allows you to specify what should happen to an email when neither SPF nor DKIM both passes authentication and aligns with the visible From domain.
  • none: Do nothing (default)
  • quarantine: Quarantine the email (spam)
  • reject: Block the email
So, if you have SPF & DKIM setup correctly, and your DMARC policy is reject, only authenticated emails will be accepted, and the unauthenticated fraud emails will be blocked.

Bulk Sender Requirements

Mailbox providers now require that domains that send over 5,000 emails a day implement DMARC along with other requirements. More information in Bulk Sender Requirements.

Deliverability

DMARC gives mailbox providers more confidence that an email is legitimate, making it less likely to be marked as spam or rejected. Implementing DMARC does not guarantee your email will be delivered, but not implementing DMARC makes it more likely that it will not be delivered.

Reporting

DMARC also supports a feature called Reporting. Reporting gives domain owners insight into the status of their email authentication. This information i invaluable for understanding how much email is being sent using their domain and if it's authenticated.

Next steps

Read DMARC Explained for the technical basics, or follow the Quick Start Guide to set up DMARC for your domain.