Email security is becoming an increasingly significant concern for both businesses and private individuals. Due to the growing prevalence of email spoofing and phishing attempts, it is vital to implement security measures to protect communication channels.

One such effective tool for securing email communication is DMARC, or Domain-based Message Authentication Reporting and Conformance. Its purpose is to authenticate email messages and take appropriate action against unauthorised emails. The DMARC policy works in conjunction with the SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) protocols.

Let’s assume that a malicious actor attempts to send a fraudulent email from your ‘example.com’ domain. As the server they are using is not authorised, the DMARC check on the email will fail. DMARC allows the domain owner to specify in their DMARC record what action the receiving server should take (none, quarantine or reject) with regard to such emails sent from their domain.

The aim of this article is to familiarise you with the complexities of DMARC, how it works, its guidelines and the important role that labels play in authentication.

How does DMARC work?

A simple explanation of how DMARC works:

1. Let’s assume that the host server receives an email from the address employee@example.com.
2. The SPF protocol checks whether the sending server is authorised to send emails on behalf of example.com.
3. DKIM also uses cryptographic signatures to verify the integrity of received emails. It ensures that the email has not been tampered with whilst in transit.
4. DMARC then ensures that the domain listed in the ‘From’ header matches the domains verified by SPF and DKIM (in this case, example.com).
5. If the email received does not comply with the SPF and/or DKIM protocols, DMARC will mark it as unauthorised.
6. If an email does not comply with DMARC, the receiving server will take action in accordance with the instructions specified by the domain owner in the DMARC record:
   • ‘None’ instructs you not to take any action.
   • Karantén instructs you to move the email to your spam folder.
   • ‘Reject’ means to reject the comment or to reject the post entirely.
7. The host server is required to send a report to the domain owner regarding email traffic and authentication errors (if any).

Video: What is DMARC? | DMARC Explained In Plain English | EasyDMARC (EasyDMARC)

What is a DMARC record?

A DMARC record is a DNS (Domain Name System) entry that instructs receiving email servers on how to handle unauthorised emails that have failed the DMARC check. The DMARC record is written in a specific format and stored in the domain’s DNS settings. The record contains clear instructions regarding the following:

• The DMARC policy (None, Quarantine, Reject)
• Where should you send feedback reports about authentication errors?

Here is an example of a DMARC record:

v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com

What is a DMARC policy?

If you set up DMARC for your domain and enforce it, receiving servers will become aware of your domain’s policies. They will know whether you want unauthorised emails to be rejected or quarantined. They use this information to take appropriate action when they receive an email that fails the DMARC check.

The three policies that can be configured in the DMARC record are listed below:

p=none The ‘none’ policy means that the domain holder wants the receiving server to retain failed emails in their original form, deliver them to the recipient’s inbox, and take no further action. The ‘none’ policy is mainly used by new domains for monitoring purposes. The data collected is useful when initially setting up DMARC.

p=quarantine

The quarantine policy indicates that the domain owner would like the recipient’s server to send unauthorised emails to the spam or junk folder. This policy helps strike the right balance between security and user experience.

p=reject

This is the strictest of the three guidelines and requires the receiving server to reject failed emails immediately. Unauthorised emails are returned to the sender.

The policy chosen by the domain owner depends entirely on the maturity of the email authentication settings. Initially, it is better to start with a ‘no policy’ setting in order to gather detailed data and insights. Eventually, domain owners can move from ‘no policy’ to ‘quarantine’ and then to ‘rejection’.

DMARC tags

DMARC tags are various parameters within the DMARC record that are used to enable greater customisation and control. Each tag has a specific function. Let’s take a look at the most commonly used DMARC tags and their purposes:

• Version (v) tag: As the name suggests, this tag indicates the version of the DMARC protocol. For example, DMARC1.
• Policy (p) tag: Specifies the policy that the domain owner requires the hosting server to follow (none, quarantine, rejection).

• Reports email addresses (rua) tag: This tag specifies the email address for aggregated reports.

• Report interval (ri) tag: This tag sets the interval at which summary reports are sent.
• Report email addresses (ruf) tag: Tells the receiving server where to send the feedback reports.
• Report Format (rf) tag: This tag helps to define the format of the forensic report.
• ‘Forensic Reporting Options (fo)’ tag: This tag determines how forensic reports are generated and displayed to the domain owner.
• Subdomain policy (sp) tag: This tag is used to define the policy regarding subdomains.
• aspf tag: Specifies the SPF alignment mode. It can be set to either lenient or strict mode.
• adkim tag: Specifies the DKIM alignment mode. In ‘loose’ mode, any subdomain of the ‘From’ domain will pass the DKIM check. In ‘strict’ mode, only an exact match of the ‘From’ domain will pass the DKIM check.
• Percentage (pct) tag: This tag specifies the exact percentage of emails to be filtered.

• email delivery
• dns
• phishing
• guides