DMARC. Domain-based Message Authentication, Reporting & Conformance

DMARC is the first and only email authentication technology that can make the From address that users see in their email clients trustworthy.

DMARC is a relatively new advance in email authentication. It was created in 2011 and has since been adopted by senders and mailbox providers alike to prevent phishing and spoofing. Return Path was a founding contributor of the DMARC framework and we’re proud to have been involved from the very beginning.

Having a DMARC record for your email marketing efforts ensures that legitimate email is properly authenticating against established set standards and that fraudulent activity appearing to come from domains under the organization’s control (your active sending domains, non-sending domains, and defensively registered domains) is blocked. Two key values of DMARC are domain alignment and reporting.

The alignment feature prevents spoofing of the “header from” address by:

  1. Matching the “header from” domain name with the “envelope from” domain name used during an SPF check, and
  2. Matching the “header from” domain name with the “d= domain name” in the DKIM signature.

Step 1: Verify domain alignment (a.k.a. identifier alignment)

Open the email headers from the emails you send. Identify the domain or subdomain listed in the following email places:

  • The Envelope From (e.g., Proofpoint or Mail-From)
  • The “Friendly” From (e.g., “Header” From)
  • The d=domain in the DKIM-Signature (if present)

Are your domain names identical, or subdomains of the same top-level domain? If so, then your domains are aligned and you will be able to instruct mailbox providers to reject any malicious emails purporting to be from your brand. If not, you can still proceed to create your DMARC record and work with your messaging, IT, and/or security teams to get aligned.

Step 2: Identify email accounts to receive DMARC reports

Through DMARC, you will receive aggregate and forensic (message level) reports daily. Designate the email account(s) where you want to receive these reports. You may want to use two separate accounts, as you could get inundated with the data.

DMARC reports are very difficult to parse because they are provided in raw format. Partnering with a company like Proofpoint can help you and your team make sense of them—fast.

Step 3: Learn the DMARC tags DMARC tags are the language of the DMARC standard

They tell the email receiver (1) to check for DMARC and (2) what to do with messages that fail DMARC authentication. There are many DMARC tags available, but you do not have to use them all. In fact, we recommend keeping it simple. Focus on the following tags:

  • v=
  • p=
  • fo=
  • rua
  • ruf

Step 4: Ask us to Generate your DMARC record

Using our DMARC Creation Wizard, we will generate you a DMARC text record in your DNS for each sending domain. Your mail receiver policy will automatically be set to “none,” indicating DMARC’s “monitor” mode (p=none).

Monitoring allows us to gather information on your entire email ecosystem, including who is sending email on behalf of your brand (and who is pretending to do so, maliciously!), what emails are authenticating, and what emails are not.

Your record should look something like this:

v=DMARC1; p=none; fo=1; rua=mailto:[email protected];ruf=mailto:[email protected]

Congratulations! You have created your DMARC record. The next step is implementation.

Step 5: Implement your DMARC record into DNS

Work with your DNS server administrator to add your DMARC record to DNS and start monitoring your chosen domain, which might be your primary domain or a carefully selected other domain for testing. You will start receiving reports and see where email traffic using that domain is coming from. Perhaps you will identify some vendors, partners or platforms you didn’t realize were sending on your behalf.

Perhaps you will be surprised to find that there is—or isn’t—a significant volume of fraudulent messages using that domain and where those messages are coming from.

...and you're done!

  1. Setup SPF
  2. Setup DKIM
  3. Setup DMARC