DMARC - Postmaster+ by OptiPub

Domain-based Message Authentication, Reporting & Conformance (DMARC)

Domain-based Message Authentication, Reporting & Conformance (DMARC) is an email protocol that uses SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail), and adds a reporting function that allows senders and receivers to improve and monitor protection of the domain from fraudulent email.

DMARC is important for a number of reasons:

  1. Preventing Email Spoofing: DMARC helps to prevent attackers from spoofing the "From" address in emails. Spoofing is a common technique used in phishing and spam emails, where the attacker makes the email appear to come from a trusted source.

  2. Domain Reputation: Having a DMARC record and policy in place can protect the reputation of a domain. If a domain is spoofed frequently, it can end up on spam lists, reducing the effectiveness of genuine emails sent from that domain.

  3. Improved Deliverability: Many email providers check for DMARC records and use the information as part of their decision-making process for email delivery. A domain with a DMARC policy may have a higher likelihood of having its emails delivered to the recipient's inbox instead of being marked as spam or being rejected.

  4. Visibility and Reporting: DMARC provides robust reporting, allowing domain owners to gain visibility into who is sending email on behalf of their domain, whether these emails are authenticating properly, and how receiving servers are handling these emails based on the DMARC policy. This feedback can help domain owners maintain control over their email, identify potential authentication issues, and monitor malicious or fraudulent email activity.

Remember that implementing DMARC must be done carefully, as incorrect settings can potentially cause legitimate emails to be rejected or sent to the spam folder. It's often recommended to start with a DMARC policy of "none" for monitoring before moving to "quarantine" or "reject" once you're confident in your SPF and DKIM setup.

DMARC Configuration Options

Component Description Example
v (Version) Identifies the version of DMARC specification being used. v=DMARC1
p (Policy) Defines the policy for the domain. This can be "none" (do nothing), "quarantine" (treat as suspicious), or "reject" (block the message). p=reject
sp (Subdomain Policy) Optional. Defines the policy for subdomains of the domain. If not specified, the overall domain policy is used. sp=quarantine
ruf (Forensic Reporting URI) Optional. Provides an email address to send detailed forensic reports. ruf=mailto:forensics@example.com
rua (Aggregate Reporting URI) Optional. Provides an email address to send aggregate reports of DMARC failures. rua=mailto:reports@example.com
pct (Percentage) Optional. Specifies the percentage of messages from the domain that to which the DMARC policy is applied. pct=100
adkim (Alignment Mode for DKIM) Optional. Specifies the DKIM identifier alignment mode. This can be "r" (relaxed) or "s" (strict). adkim=r
aspf (Alignment Mode for SPF) Optional. Specifies the SPF identifier alignment mode. This can be "r" (relaxed) or "s" (strict). aspf=r


How To Setup DMARC

Here's how to set up DMARC:

  1. Ensure SPF and DKIM are set up: DMARC relies on SPF and DKIM to check email authenticity. Make sure you've set up these records correctly before proceeding with DMARC.

  2. Create a DMARC policy: A DMARC policy tells receiving mail servers what to do with emails that fail SPF or DKIM checks. The policy is defined as a TXT record in your domain's DNS. A basic DMARC record might look like this: v=DMARC1; p=none; rua=mailto:reports@yourdomain.com

    • v=DMARC1 indicates this is a DMARC record.
    • p=none is the policy for handling email that fails the DMARC check. "none" means do nothing, "quarantine" means mark it as spam or put it aside for further checking, and "reject" means reject the message outright. It's recommended to start with "none" and monitor the reports before moving to a stricter policy.
    • rua=mailto:reports@yourdomain.com is the email address where you want to receive aggregate reports about DMARC failures.

  3. Add the DMARC record to your DNS: The DMARC record should be added as a TXT record in your DNS settings. The name of the record should be _dmarc.yourdomain.com, where "yourdomain.com" is your actual domain.

  4. Test your DMARC setup: You can use a DMARC record checker to verify your DMARC setup. Just search for "DMARC record checker" and use one of the tools that comes up.

  5. Monitor your DMARC reports: DMARC reports provide valuable insights into who is sending email on your behalf and whether those emails are passing SPF and DKIM checks. Regularly reviewing these reports can help you identify any issues and fine-tune your DMARC policy.

Remember, setting up DMARC is not a one-time task. It requires ongoing monitoring and adjustment to ensure it's working effectively. However, with SPF, DKIM, and DMARC in place, you'll be well-equipped to prevent email spoofing and phishing.