DMARC

Definition DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a DNS protocol that protects a domain from being used in phishing and spoofing attacks. It tells receiving email servers what to do if an email claims to be from your domain but fails authentication checks.

How it Works: SPF, DKIM, and Alignment DMARC does not work alone; it sits on top of two other protocols:

• SPF (Sender Policy Framework) lists the IP addresses authorized to send mail on your behalf.
• DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your emails to prove they haven't been altered in transit.

For DMARC to pass, an email must pass either SPF or DKIM, and the domains must align. Alignment means the "From" address the recipient sees matches the domain authenticated by SPF or DKIM.

The Three DMARC Policies When you publish a DMARC record, you must specify a policy (p=) instructing receiving servers how to handle mail that fails authentication:

1. p=none (Monitoring): The receiver delivers the email normally but sends a report back to you. This is used for testing to see who is sending mail on your behalf without risking legitimate emails being blocked.
2. p=quarantine: The receiver accepts the email but routes it directly to the spam or junk folder.
3. p=reject: The receiver completely blocks the email. It will bounce and never reach the recipient.

Example DNS Record A standard DMARC record added as a TXT file in your DNS settings looks like this: v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com;

• v=DMARC1 defines the protocol version.
• p=quarantine applies the policy.
• rua= specifies where aggregate XML reports should be sent.

Moving to Enforcement Mailbox providers increasingly require DMARC for bulk senders. However, setting p=reject on day one is risky. A company might have a marketing automation tool (like HubSpot) sending legitimate emails that aren't properly authenticated yet. A p=reject policy would block all of those emails. The standard rollout is to stay at p=none while reviewing aggregate reports, fix any misconfigured sending sources, and only then move to p=quarantine or p=reject.