IT Granules - DMARC Lookup

What is DMARC (Domain-based Message Authentication, Reporting, and Conformance)?

DMARC, which stands for Domain-based Message Authentication, Reporting, and Conformance, is an email authentication and reporting protocol. It builds upon the SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) mechanisms to improve email authentication and combat email phishing and spoofing.

Key Points about DMARC:

1. Authentication: DMARC helps verify that the sender of an email is authorized to use the claimed domain. It leverages SPF and DKIM authentication mechanisms to achieve this.
2. Policy Setting: DMARC enables domain owners to publish policies specifying how their emails should be authenticated. This includes indicating whether SPF, DKIM, or both should pass for the email to be considered authenticated.
3. Reporting: DMARC includes a reporting mechanism where email receivers (such as ISPs and email service providers) can send aggregate and forensic reports back to the domain owner. These reports provide insights into the authentication status and potential abuse of the domain.
4. Quarantine and Reject Policies: DMARC policies can instruct receiving email servers to either "quarantine" or "reject" messages that fail authentication. Quarantine may involve sending suspicious emails to the recipient's spam or junk folder, while reject means the email is not delivered.
5. Gradual Implementation: DMARC allows domain owners to gradually implement policies, starting with monitoring mode to receive reports without affecting the delivery of emails. This helps organizations fine-tune their authentication practices before implementing stricter policies.
6. Preventing Email Spoofing: DMARC is designed to prevent email spoofing, where malicious actors send emails that appear to come from legitimate domains. By enforcing authentication and reporting, it reduces the likelihood of successful phishing attacks.
7. Public DNS Records: DMARC policies are published in the domain's DNS records, indicating how email receivers should handle messages claiming to be from that domain.

Example DMARC policy in DNS records:

_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; ruf=mailto:dmarc-forensic@example.com"