A DMARC record, short for Domain-based Message Authentication, Reporting & Conformance, is a special type of
DNS record that helps protect your domain from email spoofing and phishing attacks. It acts like an
instruction manual for receiving email servers, telling them what to do with emails that appear to come from
your domain but might be forged. It's like a set of instructions for how to handle potentially spoofed emails.
Here's a breakdown of what a DMARC record does:
Authentication: When an email arrives claiming to be from your domain, the receiving server checks for SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) records. These records specify authorized senders for your domain.
Alignment: If the email passes the authentication checks, the receiving server then compares the "From:" address in the email header with the domain identified in the SPF and DKIM records. This is called alignment.
DMARC policy: Based on the alignment outcome and the DMARC record settings, the receiving server takes
action.
The DMARC record specifies the policy, which can be:
None: No action is taken, even if the email fails authentication or alignment.
Quarantine: Suspicious emails are placed in a quarantine folder for further check.
Reject: Suspicious emails are rejected outright.
Here's an example of a DMARC record:
v=DMARC1; p=reject; rua=mailto:
[email protected]; ruf=mailto:
[email protected]
This record tells receiving servers to reject any emails that fail authentication and to send reports about them to two email addresses.
How to set up a DMARC record:
Create a DMARC policy: Decide what you want to happen to emails that fail authentication.
Generate a DMARC record: There are many online tools that can help you generate a DMARC record based on your policy.
Add the DMARC record to your DNS: Once you have your DMARC record, you need to add it to your DNS settings.
Here are some resources that you can use to learn more about DMARC:
Google's DMARC guide: https://support.google.com/a/answer/2466563?hl=en
DMARC.org: https://dmarc.org/
EasyDMARC: https://easydmarc.com/