What is DMARC Record?
A DMARC record, housed in a TXT-type DNS entry named dmarc, outlines policies and preferences for email servers. It's composed of tags assigned with values separated by semicolons.
Here are the key tags used in setting up a DMARC record:
v (DMARC Version):
Default: DMARC1
Translation: Denotes the DMARC protocol version. Must always be set as "DMARC1". If missing or incorrect, the entire DMARC record is ignored.
p (Policy):
Default: none
Translation:Specifies the action for emails failing DMARC checks.
none: Collects feedback without impacting existing flows.
quarantine: Treats suspicious emails, often directed to the spam folder.
reject: Rejects all failing emails outright.
adkim (DKIM Alignment Mode):
Default: r
Translation:Specifies the alignment mode for DKIM signatures.
"r" (Relaxed Mode): Allows DKIM domains sharing a common Organizational Domain to pass.
"s" (Strict Mode): Requires an exact match between DKIM and email header-From domains.
aspf (SPF Alignment Mode):
Default: r
Translation: Similar to adkim but for SPF authentication.
"r" (Relaxed Mode): Allows SPF domains sharing a common Organizational Domain to pass.
"s" (Strict Mode): Requires an exact match between SPF and email header-From domains.
sp (Sub-domain Policy):
Default: p= value
Translation: Allows explicit publishing of a policy for sub-domains under this DMARC record.
fo (Forensic Reporting Options):
Default: 0
Translation: Determines conditions for generating forensic reports.
"0": Generates reports if all underlying authentication mechanisms fail to produce a DMARC pass result.
"1": Generates reports if any mechanisms fail.
"d": Generates reports if DKIM signature fails.
"s": Generates reports if SPF fails.
ruf (URI for Forensic Reports):
Default: none
Translation: Specifies where to send Forensic reports (URIs in the form of "mailto:[email protected]").
rua (URI for XML Feedback):
Default: none
Translation: Specifies where to send XML feedback reports (URIs in the form of "mailto:[email protected]").
rf (Reporting Format for Forensic Reports):
Default:afrf
Translation: Determines the reporting format for individual Forensic reports.
pct (Percentage):
Default: 100
Translation: Specifies the percentage of email failures for which the policy should be applied. The policy must be "quarantine" or "reject" for the percentage tag to be applied.
ri (Reporting Interval):
Default: 86400
Translation: Sets the frequency of receiving aggregate XML reports.
Each tag serves a specific role in defining DMARC policies and mechanisms for authentication and feedback, ensuring email security and proper handling of failed checks.
For assistance in creating a DMARC record, utilizing a DMARC generator tool is recommended.
How does DMARC work?
Authentication:
SPF/DKIM Check:
Receiving servers verify SPF or DKIM authentication methods.
Domain Alignment:
Validates if the SPF domain (Return-Path) or DKIM domain (d=) aligns with the "From" domain in the email header.
DMARC Policy:
Extracts and enforces the DMARC policy from the DNS record of the "From" domain.
Alignment Modes:
Relaxed (r) Mode:
Allows subdomains in SPF/DKIM checks, comparing them to the "From" domain.
Strict (s) Mode:
Requires exact matching of SPF/DKIM domains with the "From" domain.
Reporting:
Aggregate Reports:
Include pass/fail results in periodic aggregate reports sent via specified email addresses using rua tag.
Forensic Reports:
Detailed failure rep