dmarcdmarcexamplecom

DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol designed to help email receivers detect and mitigate email spoofing, a technique used by cybercriminals to mask the origin of an email. DMARC extends existing email authentication protocols, SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail), by providing a mechanism for email senders to indicate whether their messages should be rejected if they fail SPF or DKIM checks.

A DMARC record is published in the DNS (Domain Name System) of the email sender's domain and specifies the sender's DMARC policy. The policy can be one of three values: none, quarantine, or reject. The none policy indicates that the sender does not have a DMARC policy. The quarantine policy instructs the receiver to treat messages that fail DMARC checks as suspicious and typically deliver them to a spam or junk folder. The reject policy instructs the receiver to reject messages that fail DMARC checks.

The DMARC record also includes a reporting mechanism that allows email senders to receive reports from email receivers about the DMARC checks performed on their messages. These reports can help senders identify and address email spoofing attempts.

To create a DMARC record, an email sender typically needs to publish a TXT record in their DNS with a name in the format _dmarc.example.com and a value that specifies the DMARC policy and reporting parameters. For example, a DMARC record for example.com might look like this:

v=DMARC1; p=quarantine; rua=mailto:[e-mail]; ruf=mailto:[e-mail]; sp=quarantine; adkim=s; aspf=s;

This record specifies a quarantine policy for both SPF and DKIM checks, requests aggregate reports to be sent to [e-mail], and requests forensic reports to be sent to [e-mail]. The sp parameter specifies the policy for messages that fail SPF checks, and the adkim and aspf parameters specify the alignment mode for DKIM and SPF checks, respectively.

DMARC is an important tool for email senders to protect their brand and prevent email spoofing, and for email receivers to detect and mitigate email spoofing attempts. However, DMARC is not a silver bullet and should be used in conjunction with other email authentication protocols and best practices.