VibeSecurity

Process and tools

What is DMARC?

DMARC is an email authentication policy, published as a DNS TXT record, that tells receiving mail servers what to do with messages claiming to be from your domain that fail SPF and DKIM checks, and where to send reports about them.

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. SPF and DKIM each verify something about a message, but neither checks the From address a person actually sees, and neither says what should happen on failure. DMARC closes both gaps. A message passes only if SPF or DKIM passes and the domain it verified lines up with the visible From domain, which is called alignment.

The record lives at _dmarc.your-domain.com and sets a policy: none means only monitor, quarantine means treat failing mail as suspicious, and reject means refuse it. The rua tag names an address that receives aggregate reports showing who is sending mail under your domain, including services you forgot about and anyone impersonating you.

Begin with p=none and read the reports until every legitimate sender passes, then move to quarantine and finally reject. Staying on none forever gives visibility but no protection, since forged mail is still delivered.

A monitoring policy that collects reports
_dmarc.your-domain.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@your-domain.com"

Go deeper

Related terms

Sources

  1. 1.RFC 7489: DMARC
  2. 2.DMARC.org: Overview
  3. 3.Google Workspace Help: Set up DMARC