DMARC stands for \u201cDomain-based Message Authentication, Reporting & Conformance\u201d. DMARC is an email authentication policy that builds on the well-established SPF and DKIM protocols. Just like SPF and DKIM, it helps prevent spam, phishing and email spoofing.<\/p>\n\n\n\n
DMARC is designed to protect an email sender from advanced threats that can cause a data breach. It allows an email sender to outline and create their own authentication practises and specify exactly what actions you want to take when an email fails its authentication.<\/p>\n\n\n\n
A DMARC record can be configured to send reports based on what emails are failing or passing \u201calignment\u201d. More information on this later in this guide.<\/p>\n\n\n\n
Note: <\/strong>If you\u2019re following this guide after receiving correspondence from one of your online technology providers regarding changes being made by Google and Yahoo, you may be required to generate a DMARC Policy. Specifically, you\u2019ll require DMARC if you email to 5000 or more Google\/Yahoo addresses in a 24-hour period. How does it work?<\/strong><\/p>\n\n\n\n Note: It\u2019s recommended you have a basic understanding of SPF and DKIM for this guide. A multitude of information can be found online about both SPF and DKIM email protocols.<\/strong><\/p>\n\n\n\n Have you ever found yourself in a situation where you\u2019ve received a legitimate looking email from a domain that turned out to be fraudulent? This is known as Email Spoofing.<\/p>\n\n\n\n DMARC can help prevent this type of attack by notifying the receiving server that their messages are protected by SPF and or DKIM. If a message then fails SPF\/DKIM authentication, the DMARC record will advise the receiving mail server on what do with the message. We call this \u201calignment\u201d. (A further explanation of this is in the \u201cHow is a DMARC record structured?\u201d section.)<\/p>\n\n\n\n Note: DMARC should not be used as a replacement to SPF and DKIM, but instead should be used to build on them.<\/strong><\/p>\n\n\n\n How is a DMARC record structured?<\/strong><\/p>\n\n\n\n Similar to SPF and DKIM, DMARC is added via your domain DNS settings in the form of a TXT record.<\/p>\n\n\n\n In the following section, we\u2019ll use an example DMARC Record, and then explain what each part of the record means. It\u2019s worth noting that not all parts of the record are required, and many are optional.<\/p>\n\n\n\n You\u2019ll need to specify a \u201cHost\u201d field in your DNS. The format for this starts with _DMARC. Followed by your domain name. E.g., if your domain is example.com, the Host will look like:<\/p>\n\n\n\n _DMARC.example.com<\/p>\n\n\n\n Example DMARC Record:<\/strong><\/p>\n\n\n\n V=DMARC1; p=quarantine; pct=90; rua=mailto:email@example.com ruf=mailto:mail@mail.com; sp=reject; adkim=r; aspf=s<\/p>\n\n\n\n But what does each section mean?<\/p>\n\n\n\n V=DMARC1; <\/strong>(required)<\/p>\n\n\n\n This specifies that the DNS record is a DMARC record. Without this prefix, or with it being spelt\/formatted incorrectly, the DMARC record will be ignored and will be ineffective.<\/p>\n\n\n\n P=quarantine; <\/strong>(required)<\/p>\n\n\n\n This section tells the receiving email server what to do if it fails SPF\/DKIM alignment. The options for this section are:<\/p>\n\n\n\n Pct=90; <\/strong>(optional)<\/p>\n\n\n\n PCT is an optional tag and can be omitted from your record if you do not require it. This tag tells the receiving email server what percentage of emails the policy applies to. E.g., if you set this figure to 90%, such as in our example, the receiving email server will treat 90% of emails and ignore the other 10%.<\/p>\n\n\n\n It\u2019s an effective method of checking your DMARC is working as expected.<\/p>\n\n\n\n Rua; + ruf; <\/strong>(optional)<\/p>\n\n\n\n The RUA<\/strong> report provides a high-level view of all email traffic Sent in an XML file format. This can commonly be opened in an application such as Microsoft Excel.<\/p>\n\n\n\n The RUF report gives a comprehensive overview of email messages that have failed DMARC checks. The report is sent in plain text format.<\/p>\n\n\n\n Both reports require a specified email address, as in the example above.<\/p>\n\n\n\n
\u00a0
If this applies to you, we recommend reading this guide, designed to help you understand DMARC, and then following our guide on how to use our DMARC record generator.<\/p><\/div>\n\n\n\n\n