DMARC (RFC 7489) tells receiving servers what to do with messages that use your domain in the From address without passing authentication, and where to send reports about them. This guide shows how to bring it in gradually, without blocking legitimate mail. Make the record with the DMARC generator and read the reports with the DMARC report analyzer.
When a message passes DMARC
A message passes DMARC when at least one check passes and is aligned with the From domain (RFC 7489, section 3.1):
- Aligned DKIM: a valid DKIM signature whose
d=domain matches the From domain. - Aligned SPF: SPF passes for the envelope address (
MAIL FROM, Return-Path), and its domain matches the From domain.
Alignment is needed because a message can carry a valid signature from any domain, including a mailing list's or an attacker's. A valid signature alone does not prove the message comes from the From domain.
Alignment has two modes, chosen with adkim and aspf:
| Mode | Meaning | Example: From alerts@news.example.com |
|---|---|---|
r (relaxed, default) | same organizational domain | passes with d=example.com |
s (strict) | exactly the same name | passes only with d=news.example.com |
Relaxed is usually the right choice: strict also fails mail from subdomains signed with the main domain.
The record
DMARC is a TXT record at _dmarc. + domain. The first tags must be v=DMARC1, then p, in that order (section 6.3):
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"| Tag | Default | What it does |
|---|---|---|
p | required | the policy: none, quarantine or reject |
sp | as p | the policy for subdomains |
pct | 100 | the share of messages the policy applies to |
rua | none | where the daily aggregate reports go |
ruf | none | where reports about individual messages go |
adkim, aspf | r | the alignment mode |
Without rua, servers send no aggregate reports (section 6.3). Without reports you cannot see what would be blocked, so rua is the first thing to add.
Step 1: p=none and reports
Start with p=none. The policy changes nothing about delivery, but servers that implement DMARC start sending you daily aggregate reports: from which IP addresses mail with your domain in From was sent, how many messages and with which SPF and DKIM results (section 7.2).
The reports arrive as XML attachments, usually compressed. In the report analyzer you see the sources, what passes and what fails. For each failing source:
- You recognise it (a newsletter service, billing, a CRM, your own server): set up SPF or, better, DKIM with your domain for it.
- You do not: it is most likely someone using your domain without permission. That is exactly what the later policy will stop.
Keep p=none for at least a few weeks, to catch the sources that send rarely, monthly invoices for example.
Step 2: quarantine, gradually
When the legitimate sources pass, move to p=quarantine. Failing messages usually end up in spam. With pct you can apply the policy to part of the messages only:
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.compct does not change the reports: every message is reported, whatever the share (section 6.6.4). Raise it (25, 50, 100) while watching the reports after each step.
Step 3: reject
p=reject asks servers to reject failing messages, preferably during the SMTP conversation itself (section 6.3). It is full protection against the forging of your domain.
A detail from section 6.6.4: with p=reject and pct below 100, the messages outside the share are treated as under quarantine, not delivered normally. Moving from quarantine to reject weakens nothing on the way.
Forwarding and mailing lists
A message forwarded automatically (an old address that forwards everything, say) leaves from a server other than yours, so SPF fails at the final destination (RFC 7208, section 10.3). DKIM usually survives forwarding, because the signature travels with the message.
The practical consequence: sign all your mail with DKIM, do not rely on SPF alone. The analyzer points out separately the messages that pass DMARC only through SPF. Mailing lists that change the subject or the body do break the DKIM signature, since the signature covers exactly those parts.
Subdomains
The policy at _dmarc.example.com also covers subdomains without a record of their own: servers look first at the exact From domain, then at the organizational domain (section 6.6.3). With sp you give subdomains another policy, for example p=quarantine; sp=reject when subdomains send no mail at all.
Reports to another domain
If the reports must go to a domain other than yours (an analysis service, say), that domain has to confirm it accepts them, or servers will not send them. The confirmation is a v=DMARC1 TXT record at example.com._report._dmarc.destination-domain (section 7.1). The DMARC generator checks this confirmation for the rua and ruf addresses automatically.