Securing an email domain is an essential part of today's digital security. Phishing or spoofing attacks are a problem for many domain owners, and they can harm the reputation of their domain. DMARC is a powerful solution to these issues which verifies the identity of the sender.
The easiest way to easily create a DMARC record is to add a TXT record to your DNS settings with the name _dmarc. The basic starting record is v=DMARC1; p=none; rua=mailto:youraddress@example.com. This record will instruct email providers to track your e-mail traffic and notify you of it without blocking any e-mail messages. You can then upgrade this policy to quarantine or reject once you're sure your legitimate mail is authenticating properly.
An in-depth guide that covers all the terminology and advanced troubleshooting. You'll understand how to protect your brand and ensure your messages always get to your customers' Inbox.
What DMARC Is and Why Your Domain Needs It
DMARC is an acronym that means Domain-based Message Authentication Reporting and Conformance. An e-mail authentication protocol that allows a domain owner to prevent unauthorized use of his domain. This includes protection against spoofed emails and failure to prevent phishing. If DMARC is not in place, then any malicious email sender could possibly send an email pretending to be from your official address.
A DMARC record is a DNS TXT record that is published at a particular place on your domain. This is always _dmarc.yourdomain.com. Publish this data receiving systems, such as Gmail or Microsoft 365, can determine what you've instructed them to do. They employ these instructions to determine the action to take on messages that are being dropped for security reasons. There are formal standards in RFC 7489, and organisations, such as DMARC.org that assist in the ecosystem.
Key Benefits of Implementation
- 1. It blocks hackers from sending email in your name.
- 2. It enhances email deliverability by making it easier for email providers to determine that you're a legitimate sender.
- 3. It offers you insights into who is sending mail on your domain via detailed reports.
- 4. It aids you in determining misconfigured mail servers or third-party services that aren't supposed to be there.
How DMARC Works With Email Authentication
DMARC is not an end unto itself. It relies on two older systems (SPF and DKIM). SPF or Sender Policy Framework is used to determine whether or not a particular mail server is allowed to send messages as your domain. DKIM (DomainKeys Identified Mail) is an email authentication method that introduces a digital signature into each message. This signature proves that the information has not been modified en route.
These checks are complemented by "Alignment" added by DMARC. The alignment is that the domain in the "From" header, as it appears in the email, matches the domain that was verified by SPF or DKIM. There are two types of alignment settings:
| Alignment Type | Requirement | Best Use Case |
|---|---|---|
| Relaxed Alignment | Allows subdomains to match the main domain. | General business use with multiple services. |
| Strict Alignment | Requires an exact match between domains. | High-security environments or financial institutions. |
Prerequisites Before You Create a DMARC Record
A strong foundation is essential for setting up DMARC. You need to be able to access your DNS management console. This could be via your domain registrar or your host. You will also have to make sure that your SPF and DKIM records are active and correct.
It is important to implement your strict DMARC policy prior to your SPF and DKIM record updates to avoid your legitimate emails being blocked. Always begin by having a monitoring policy to determine how your current setup is doing.
SPF and DKIM Readiness Checklist
- 1. Make sure you have all of your IP addresses and third-party apps (e.g., Mailchimp or Zendesk) listed in your SPF record.
- 2. Ensure that DKIM keys are created and enabled for each of the platforms you send from.
- 3. Draw a diagram of all the systems that communicate with the company's mail such as marketing or HR purposes.
- 4. Make sure that a separate email address is given for technical XML reports.
If you are using specific platforms, each has detailed help guides available – try the Microsoft 365 DMARC guide or the Google Workspace DMARC documentation.
How to Create a DMARC Record Step by Step
The record is formed by picking certain "tags" that instruct the receiver on how to act. They each represent a different meaning and effect on your mail flow. To make few mistakes, most beginners should take a phased approach.
Step 1 Select Your Policy Tags
v=DMARC1 is always the first line in the record. This identifies the version of the protocol. The next tag, after that, is the “p” tag (or policy). To get aggregate reports, you must also have the "rua" tag. Such reports are vital to knowing the flow of mail.
Common Tag Definitions
- 1. None = monitor only; do not take action.
- 2. p = quarantine (Mail with errors will be placed in the spam folder).
- 3. reject means p equals reject; that is, reject all failures in mail.
- 4. pct = 100 - Policy applies to all emails.
- 5. sp is used to set a policy for your subdomains separately.
Step 2 Publish Your DMARC Record in DNS
When your record syntax is completed, you'll need to add it to your DNS host. Go to your DNS and add a new Record. Select the "TXT" record type. In the host field type _dmarc. In the value or content field paste your DMARC string. Use the default setting or 1 hour for the TTL.
To make sure your syntax is flawless before saving, use a tool such as the dmarcian Record Wizard or the MXToolBox Generator.
Choosing the Right DMARC Policy
The most important thing in your setup is selecting a policy. Security and risk of loss of critical mail must be balanced. Experts agree that there are three stages for a rollout.
The Monitoring Phase (p=none)
This is where you will start in all domains, if you have to. It's an option that lets you know who is sending mail in your name without risk of rejection. This stage should be maintained for 2-4 weeks. You will get aggregate reports in this period indicating which servers are failing or passing checks.
The Testing Phase (p=quarantine)
After you are sure you've authenticated all of your valid mail, you can proceed to quarantine. This policy instructs Gmail/Outlook to move any suspicious mail to the junk folder. This is a great feature to "test" your enforcement without totally deleting messages. An additional precautionary measure can be taken by applying the pct tag to only 10% or 50% of mail.
The Enforcement Phase (p=reject)
Email security's best hope is that this will become a reality. A reject policy instructs receivers to discard any mail that doesn't pass DMARC. This helps to put an end to spoofing. This should be used only when your reports indicate 99% or 100% agreement for all of your known sources of sending.
Testing and Monitoring Your DMARC Setup
Once you've published the record, you must check if it is accessible to the rest of the world. To ensure your record is in force you can use tools such as the DNSChecker DMARC Validator. Just a record, however, is not sufficient. Reports MUST be read.
Reports of the aggregates are generated and delivered daily in XML format. These files are difficult to human read. A visualization service is used by many to convert this data into charts and maps. Implementing tools such as EasyDMARC or Delivery Center will make it easier to tell which IPs are not being authenticated. It is possible to determine if somebody has hacked into your site or if you have forgotten to update legitimate services.
Troubleshooting Common Problems
- 1. If you have more than one DMARC record on the same domain, all of them will be ignored.
- 2. The record will be broken if you leave out a semicolon or miss a letter in the mailto address.
- 3. The result of failing to update your SPF record when you switch email service will be failures.
- 4. If your subdomains do send different or legitimate email, then use a strict subdomain policy.
When to Ramp Up Enforcement
Don't rush into changing a none policy to a reject policy. Don't rush this process. If you are getting lots of "Fail" results in your reports, you'll need to find out where they are coming from. It could be an obsolete server in another office or a marketing application in another department. After you have these sources authorised and aligned you can safely raise your level of security.
If you implement DMARC correctly, you will safeguard your brand and make sure your messages are delivered to your customers. This is a single investment that offers peace of mind for the long-term. In this guide, you'll learn how to construct a more secure environment for your email today.
