DMARC Deep Dive

DMARC (Domain-based Message Authentication, Reporting & Conformance) is the keystone protocol that ties SPF and DKIM together with a domain-level policy. Defined in RFC 7489, DMARC solves a critical gap: SPF and DKIM alone don't protect the visible "From:" address that users see.

DMARC adds three essential capabilities:

1. Alignment: Ensures the domain in the visible From: header matches the domain authenticated by SPF and/or DKIM.
2. Policy: Tells receiving servers what to do with emails that fail authentication (none/quarantine/reject).
3. Reporting: Provides visibility into who is sending email using your domain via Aggregate und Forensic Reports.

DMARC is published as a DNS TXT record at _dmarc.example.com.

Complete Tag Reference

* rua is technically optional but strongly recommended — without it, you get no visibility.

Example Records

# Monitoring mode (start here)
v=DMARC1; p=none; rua=mailto:dmarc@example.com; ruf=mailto:forensic@example.com

# Quarantine mode (next step)
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com; adkim=r; aspf=r

# Full enforcement
v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s; pct=100

Alignment is DMARC's most important concept. It ensures that the domain authenticated by SPF or DKIM matches the domain in the visible "From:" header.

Relaxed vs. Strict Alignment

Alignment Examples

# Email From: user@example.com

# SPF Relaxed Alignment
Return-Path: bounce@example.com      → Aligned ✅ (same Organizational Domain)
Return-Path: bounce@mail.example.com → Aligned ✅ (same Organizational Domain)
Return-Path: bounce@other.com        → NOT Aligned ❌

# DKIM Relaxed Alignment
DKIM d=example.com    → Aligned ✅
DKIM d=mx.example.com → Aligned ✅ (same Organizational Domain)
DKIM d=google.com     → NOT Aligned ❌

# For DMARC to PASS: At least ONE of SPF or DKIM must both PASS and be ALIGNED

The DMARC policy (p=) tells receiving servers what to do with emails that fail authentication. The recommended approach is a gradual rollout:

Phase 1: Monitor (p=none)

• No emails are blocked or quarantined
• Aggregate Reports are collected to understand your email ecosystem
• Use this phase to identify all legitimate senders and fix authentication issues
• Duration: 2-4 weeks minimum, often 2-3 months for complex organizations

Phase 2: Quarantine (p=quarantine)

• Failing emails are flagged as suspicious (typically moved to spam/junk)
• Start with pct=10 to apply the policy to only 10% of failing emails
• Gradually increase: 10% → 25% → 50% → 75% → 100%
• Monitor reports at each stage for legitimate email being affected

Phase 3: Reject (p=reject)

• Failing emails are silently dropped — they never reach the recipient
• This is the strongest protection against Spoofing
• Again, start with a low pct and gradually increase
• Make sure ALL legitimate senders are properly authenticated before going to 100%