The basics of DMARC

To authenticate your domain, you need to add an SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and a verification record to your domain’s DNS settings.

DMARC (Domain-based Message Authentication, Reporting & Conformance) is an additional email authentication protocol that many mailbox providers require for bulk senders.

DMARC is an email authentication, policy, and reporting protocol that is set up as a TXT record in the DNS settings of a domain. It provides validation of the origin of emails by inspecting the sender's IP address. 

A DMARC policy can help protect a domain from direct domain spoofing through DKIM and SPF identifier alignment. In other words, if the DKIM and/or SPF record of an email message that claims to be from your domain fails to pass, the DMARC policy tells the recipients’ email servers what to do with it. This helps identify fraudulent emails from legitimate emails and prevents scams from occurring.

DMARC record policies

There are three DMARC policies that you can use according to your needs:

• p=none - Known as the monitor policy, it doesn’t tell the recipients’ email servers to do anything, but it allows you to track the emails that are being sent on your domain’s behalf. 

• p=quarantine - Tells the recipients’ email servers to send the message to the junk or spam folder if it fails the DMARC check. It also tracks all of the emails that are sent on your behalf.

• p=reject - Tells the recipients’ email servers to reject all emails that fail the DMARC check. This causes these emails to bounce and not be delivered to any recipient folder. It also tracks all of the emails that are sent on your behalf.

Reporting

DMARC reports provide details about the authentication status of messages sent on behalf of a domain. They allow the domain owner to see which emails sent from their domain have passed or failed the SPF and DKIM authentication. 

To receive these reports, the DMARC record needs to include the RUA tag (rua=mailto:address@domain.com). DMARC reporting organizations then send the reports to this email address.

It is recommended to set up a DMARC policy for all senders, especially those sending high volumes of emails (5k+ per day), at high risk of being spoofed, or wanting to track emails sent on behalf of their domain via the reporting functionality it provides.

You can add a basic DMARC record to your domain’s DNS by:

1. Selecting the TXT record type. 

2. Adding _dmarc to the name field. 

3. Setting v=DMARC1; p=none; as the record value. 

If you need a more complex DMARC setup (e.g., stricter policy or reporting), we recommend consulting a specialist to reduce any potential negative impact on your email delivery.