💡
What You'll Learn
DMARC is the policy layer built on top of SPF and DKIM. It tells email providers what to do when messages fail authentication and provides reports back to domain owners. This makes it one of the most powerful tools for preventing email spoofing and phishing.
📖 What is DMARC? (Domain-based Message Authentication, Reporting, and Conformance)
Lesson 10
3 min read
Interactive
Introduction
We’ve learned about SPF and DKIM—two authentication methods that prove who is allowed to send mail on behalf of your domain. But what happens if someone tries to fake your domain and fails these checks? That’s where DMARC steps in.
DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. It’s like your domain’s instruction manual for email providers:
- Authentication: Checks if emails pass SPF and/or DKIM.
- Policy (Conformance): Tells receivers what to do with failed messages.
- Reporting: Sends feedback to domain owners about who is sending mail using their domain.
How DMARC Works
- Sender publishes DMARC record in DNS (a TXT record).
- Incoming mail server checks SPF and DKIM.
- DMARC applies policy based on results:
none → just monitor, take no action.
quarantine → suspicious emails go to spam/junk.
reject → block the email entirely.
- Reports are sent back to the domain owner with details about authentication results.
Why DMARC Matters
- Protects your brand: Prevents attackers from spoofing your domain.
- Improves deliverability: ISPs trust domains with DMARC.
- Provides visibility: Reports show who is sending mail as you.
- Completes the “authentication trio” with SPF + DKIM.
Example DMARC Record
_dmarc.inboxsensei.com IN TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1"
Explanation
_dmarc.inboxsensei.com
- DMARC records always live under the special subdomain _dmarc..
- This means it applies to all mail sent from @inboxsensei.com.
IN TXT
- Just like SPF and DKIM, DMARC is published as a DNS TXT record.
The value:
v=DMARC1
- Version → Always DMARC1.
p=quarantine
- Policy → What you want recipient mail servers (Gmail, Outlook, Yahoo, etc.) to do if an email fails DMARC checks (SPF/DKIM don’t align).
none → monitor only.
quarantine → send suspicious mail to spam/junk.
reject → outright block it.
rua=mailto:[email protected]
- Aggregate reports address → Mail servers send daily XML summaries of all DMARC activity here.
Example: “1000 emails passed, 50 failed, here’s why.”
ruf=mailto:[email protected]
- Forensic reports address → Some mail servers send individual copies of failed emails (stripped for privacy sometimes). Useful for deep debugging.
fo=1
- Failure reporting option → 1 means: send forensic reports if either SPF or DKIM fails.
- Other options exist (like 0, d, s) but 1 is the most common.
🥋 Sensei Tip
Always start with p=none to collect reports safely. Once you’re confident no legitimate mail is being blocked, move to quarantine and eventually reject for maximum protection.
⏱️ Est. reading time: 3 minutes
Continue Learning
Navigate through your learning journey
Next Lesson
Congratulations!
You've completed this lesson series