DMARC record setup guide

Have you ever received a suspicious email that seemed to come from your CEO, bank, or favorite online store? If so, you're not alone. The convenience of email brings risks along with it.

Email spoofing and phishing attacks are rampant, targeting individuals and businesses alike. Email authentication protocols like DMARC, SPF, and DKIM are essential tools to help manage these risks.

What is DMARC?

DMARC is a security tool that helps prevent email-based attacks, such as email spoofing and phishing. DMARC stands for Domain-based Message Authentication, Reporting, and Conformance.

DMARC simplifies the email verification process by aligning SPF and DKIM protocols. It also provides a reporting mechanism that allows you to track your email performance.

It empowers domain owners and businesses, instructing email providers on how to handle messages from their domains.

How DMARC protects your domain from Spoofing and Phishing

DMARC relies on two other security protocols: SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail). Both of these protocols are designed to prevent email spoofing.

• SPF

  Verifies if the server sending the email is whitelisted.

• DKIM

  Ensures that an email is authentic and hasn't been tampered with by adding a digital signature.

SPF and DKIM Authentication

When an email is received, the server checks the SPF record to confirm if the email originates from an approved IP address. Next, it verifies the DKIM signature to ensure the email wasn’t modified in transit.

DMARC Verification

After SPF and DKIM checks, DMARC takes over. It verifies that your email aligns with either SPF and DKIM rules - known as "alignment". DMARC ensures the “From” address in the email header matches the domains in either SPF and DKIM checks. If the domains match, your email is considered DMARC-aligned.

DMARC Policy

If the email passes, it gets delivered. But if something doesn’t match up, your DMARC policy dictates the next step:

• none

  Takes no action but reports the failure.

• quarantine

  Sends the email to the recipient’s spam or junk folder.

• reject

  Blocks the email completely, so it never reaches the inbox.

Reporting

One of DMARC's most valuable features is its reporting system. DMARC sends reports to the domain owner, detailing attempts to send emails from their domain. This insight helps ensure email legitimacy.

Why DMARC Matters

Without DMARC, suspicious emails might end up in your customers’ inboxes, potentially leading to confusion or data breaches.

DMARC is the final piece in the email security puzzle that includes SPF and DKIM. SPF verifies the sender’s IP address, DKIM secures the email’s integrity, and DMARC acts as the gatekeeper.

Based on your DMARC policy, it either lets the email through or stops it.

How to Check Your Domain for a DMARC Record

If you're wondering how to check if your domain has a DMARC record, you're in the right place. Finding DMARC records is simple. You can either do a DNS (Domain Name System) lookup or use tools designed for this purpose.

Steps to Locate DMARC Records via DNS Lookup

DMARC records are stored in your domain's DNS settings, which function like the internet’s phonebook. Here’s how to find them:

1. Access your DNS Records

   Start by logging into your DNS management platform through your domain registrar or hosting provider.

2. Locate TXT Records

   DMARC records are stored as TXT (text) records. Look for TXT records starting with _dmarc.

3. Check the configuration

   Once you find the DMARC record, verify its configuration. Look for essential tags like v=DMARC1 (version), p= (policy), and rua=mailto: (reports destination). Missing any of these tags means DMARC isn't fully set up.

Basic DMARC Syntax

A DMARC record starts with a version tag and includes other tags defining your domain’s policy. Here’s a basic example: v=DMARC1; p=none; rua=mailto:your-domain.com@rua.dmarcdkim.io; ruf=mailto:your-domain.com@ruf.dmarcdkim.io; adkim=s; aspf=r; ri=3600; fo=0:1:d:s

• v=DMARC1

  Specifies the DMARC version. Currently, DMARC1 is the only version.

• p=none

  The policy tag, instructing servers to take no action if emails failing DMARC.

• rua=mailto:

  Designates the email address to receive aggregate DMARC reports.

• ruf=mailto:

  Specifies where to send forensic failure reports.

Common DMARC Policy Tags

Tag	Description	Example
v	DMARC protocol version (always DMARC1).	v=DMARC1
p	Policy for failed DMARC checks: none, quarantine, or reject.	p=reject
sp	Subdomain policy, specifying a separate rule for subdomains if needed.	sp=quarantine
rua	URI for daily aggregate reports.	rua=mailto:your-domain.com@rua.dmarcdkim.io
ruf	URI for detailed forensic failure reports.	ruf=mailto:your-domain.com@ruf.dmarcdkim.io
pct	Percentage of emails to apply the DMARC policy to (0-100%).	pct=100
adkim	DKIM alignment mode (r for relaxed, s for strict).	adkim=s
aspf	SPF alignment mode (r for relaxed, s for strict).	aspf=r

How to Check Existing DMARC Records

To verify if your domain has a DMARC record, use a DMARC check tool. This tool also helps you generate an effective DMARC policy and provides actionable reports and DMARC analytics.

Conclusion

If you receive malicious emails, there’s a high chance of personal data theft, financial fraud, or even identity theft. Implementing DMARC, SPF, and DKIM creates a safer digital environment for both your business and customers.

DMARC FAQs

Who needs DMARC?

DMARC is essential for any organization that sends emails from its domain. It protects your brand, customers, and reputation from email spoofing and phishing attacks.

Is DMARC better than SPF?

DMARC, SPF, and DKIM together provide comprehensive email security. SPF alone only checks if an email originates from an authorized server but doesn’t stop all spoofing attempts.

Does Gmail use DMARC?

Yes, Gmail supports and uses DMARC for sending and receiving emails, encouraging domain owners to implement DMARC, SPF, and DKIM to combat email spoofing.

Is DMARC free?

Yes, DMARC is free to implement! DMARC Analytics tools like DmarcDkim.com allow you to set up DMARC records at no extra cost. However, storage for extensive DMARC reports, advanced data analysis, and personalized consultation may come with additional fees.