What is Domain-Based Message Authentication, Reporting & Conformance(DMARC)?

Email remains one of the most critical forms of communication for businesses, individuals, and organizations around the world.

However, it also presents a major attack vector for cybercriminals, who use various techniques such as phishing, spoofing, and other email-based attacks to exploit vulnerabilities.

To combat these threats, several email authentication protocols have been introduced, including Domain-based Message Authentication, Reporting & Conformance (DMARC).

DMARC is part of a trio of protocols designed to enhance email security by allowing email senders to specify policies for handling fraudulent or suspicious emails.

In this article, we will explore DMARC in detail, examining how it works, why it is essential, and how it interacts with other email authentication protocols such as SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail).

By the end of this article, you will have a comprehensive understanding of DMARC and its role in protecting your email domains from abuse.

DMARC: An Overview

DMARC is an email authentication protocol that gives domain owners the ability to protect their domain from unauthorized use, such as in phishing attacks, email spoofing, and other fraudulent activities.

DMARC builds on the foundation laid by two other email authentication protocols: SPF and DKIM.

While SPF allows domain owners to specify which mail servers are authorized to send emails on behalf of their domain, and DKIM uses cryptographic signatures to verify that the content of an email has not been altered in transit, DMARC adds a layer of protection by enabling domain owners to specify how email receivers should handle messages that fail SPF or DKIM checks.

DMARC works by allowing domain owners to publish their email authentication policies in the Domain Name System (DNS) as DNS TXT records.

These policies instruct email receivers on what to do with emails that do not pass SPF or DKIM authentication checks. Through DMARC, domain owners can:

• Specify actions for email receivers to take when an email fails authentication (e.g., quarantine, reject, or take no action).
• Receive reports from email receivers detailing emails that passed or failed authentication, providing valuable insights into potential abuse.

DMARC is defined in RFC 7489, which outlines the protocol’s technical specifications and how it integrates with other email authentication mechanisms.

The Role of SPF, DKIM, and DMARC

Before diving deeper into DMARC, it is important to understand how it fits into the broader framework of email authentication alongside SPF and DKIM.

SPF (Sender Policy Framework)

SPF is an email authentication method that allows domain owners to specify which mail servers are authorized to send emails on behalf of their domain.

SPF works by adding a DNS TXT record to the domain, which lists the IP addresses of authorized mail servers. When an email is received, the recipient’s mail server checks the SPF record to verify whether the sending server is authorized to send emails to that domain.

If the email is sent from an unauthorized server, the SPF check fails, and the email may be marked as suspicious or fraudulent.

DKIM (DomainKeys Identified Mail)

DKIM is another email authentication protocol that focuses on verifying the integrity of an email’s content. With DKIM, the sending server adds a cryptographic signature to the email header.

This signature is generated using a private key that corresponds to a public key published in the domain’s DNS.

When the email is received, the recipient’s mail server uses the public key to verify the signature and ensure that the email has not been tampered with during transit.

DKIM helps ensure that the content of an email has not been altered and that the email originated from a legitimate source.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC builds on SPF and DKIM by providing a framework for domain owners to specify what actions should be taken when an email fails SPF and/or DKIM authentication checks.

DMARC also adds a reporting mechanism, allowing domain owners to receive feedback from email receivers about the authentication results of emails sent from their domain. The key components of DMARC include:

• DMARC Policies: Domain owners can specify how email receivers should handle unauthenticated emails. The three main policy options are:
  • None: No specific action is required for failed emails, but reports are still sent to the domain owner. This policy is often used for testing and monitoring.
  • Quarantine: Emails that fail authentication should be treated cautiously and delivered to the recipient’s spam or junk folder.
  • Reject: Emails that fail authentication should be outright rejected and not delivered.
• DMARC Reports: DMARC enables domain owners to receive two types of reports:
  • Aggregate Reports: These reports provide a summary of all emails sent from the domain, including details about how many passed or failed SPF and DKIM checks.
  • Forensic Reports: These reports provide detailed information about individual emails that failed authentication, including the sender’s IP address and the reasons for failure.

DMARC relies on both SPF and DKIM to function properly. If either SPF or DKIM passes, the email is considered authenticated.

However, if both fail, DMARC policies are applied to determine how the email should be handled.

How DMARC Works

To understand how DMARC works in practice, let’s take a closer look at the steps involved when an email is sent from one domain to another:

1. Email is Sent: The domain owner sends an email to a recipient. The email is transmitted from the sending mail server to the receiving mail server.
2. SPF and DKIM Checks: The recipient’s mail server performs SPF and DKIM checks to verify the authenticity of the email. The SPF check verifies if the sending server is authorized to send emails for the domain, while the DKIM check verifies the cryptographic signature in the email header.
3. DMARC Check: After performing the SPF and DKIM checks, the recipient’s mail server retrieves the DMARC record from the sender’s DNS. This record specifies the domain owner’s policies for handling unauthenticated emails.
4. Policy Application: Based on the results of the SPF and DKIM checks, the DMARC policy is applied. If the email fails both SPF and DKIM, the recipient’s mail server takes the action specified in the DMARC policy (none, quarantine, or reject).
5. Report Generation: The recipient’s mail server generates a DMARC report (either aggregate or forensic) and sends it to the domain owner, providing valuable insights into the authentication results of the email.

By following these steps, DMARC helps prevent unauthorized emails from being delivered, reducing the risk of phishing, spoofing, and other email-based attacks.

DMARC Record Structure

DMARC policies are published in the DNS as DNS TXT records. A typical DMARC record looks like this:

_dmarc.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com; ruf=mailto:forensic-reports@example.com; sp=reject; aspf=r"

Let’s break down the components of this DMARC record:

• _dmarc.example.com: The DMARC record is published under the subdomain _dmarc for the domain example.com.
• v=DMARC1: This specifies the version of DMARC being used, which is currently DMARC1.
• p=quarantine: The p tag specifies the DMARC policy for the domain. In this case, the policy is set to “quarantine,” meaning emails that fail authentication should be delivered to the recipient’s spam or junk folder.
• rua=mailto:dmarc-reports@example.com: The rua tag specifies the email address where aggregate DMARC reports should be sent.
• ruf=mailto:forensic-reports@example.com: The ruf tag specifies the email address where forensic DMARC reports should be sent.
• sp=reject: The sp tag specifies the policy for subdomains. In this case, the policy is set to “reject,” meaning emails from subdomains that fail authentication should be rejected.
• aspf=r: The aspf tag specifies the alignment mode for SPF. The value “r” stands for “relaxed,” meaning the SPF check will pass if the domain in the email’s “From” header matches the domain in the SPF record.

DMARC Policies

DMARC policies dictate how email receivers should handle emails that fail SPF and DKIM checks. There are three main DMARC policy options:

1. None (p=none)

This is the most lenient policy and is often used when first implementing DMARC. When the policy is set to “none,” no specific action is taken for unauthenticated emails.

However, DMARC reports are still generated and sent to the domain owner. This policy is typically used for testing purposes to monitor how many emails are failing authentication without affecting email deliverability.

2. Quarantine (p=quarantine)

When the policy is set to “quarantine,” emails that fail SPF and DKIM checks are delivered to the recipient’s spam or junk folder. This policy provides a middle-ground approach, allowing potentially suspicious emails to be delivered but flagged as suspicious.

3. Reject (p=reject)

The “reject” policy is the most strict and is used when the domain owner wants to prevent any unauthenticated emails from being delivered.

When this policy is applied, emails that fail SPF and DKIM checks are rejected outright and not delivered to the recipient. This policy is recommended once DMARC implementation has been thoroughly tested and monitored.

DMARC Reports

One of the key benefits of DMARC is the reporting feature, which provides domain owners with valuable insights into how their emails are being authenticated. There are two types of DMARC reports:

1. Aggregate Reports (rua)

Aggregate reports provide a summary of all emails sent from the domain over a specific period (typically daily).

These reports include information about how many emails passed or failed SPF and DKIM checks, the source IP address and the DMARC policy applied.

2. Forensic Reports (ruf)

Forensic reports provide more detailed information about individual emails that failed authentication.

These reports include the sender’s IP address, the email addresses in the “To” and “From” headers, and the reason for the authentication failure.

Benefits of DMARC

DMARC provides several significant benefits, especially when combined with SPF and DKIM:

• Protection Against Phishing and Spoofing: DMARC helps prevent attackers from sending fraudulent emails that appear to come from a legitimate domain, reducing the risk of phishing and email spoofing.
• Improved Email Deliverability: By implementing DMARC, domain owners can improve the deliverability of their legitimate emails. Emails that pass DMARC authentication are more likely to reach the recipient’s inbox, as they are less likely to be flagged as spam.
• Visibility and Reporting: DMARC’s reporting feature provides domain owners with valuable insights into how their emails are being authenticated. This visibility allows domain owners to identify potential abuse and take corrective actions.
• Brand Protection: DMARC helps protect a brand’s reputation by preventing unauthorized use of its domain in email communications.

In today’s digital landscape, where email-based attacks like phishing and spoofing are prevalent, DMARC plays a critical role in enhancing email security.

By building on SPF and DKIM, DMARC provides domain owners with the ability to specify how unauthenticated emails should be handled and receive detailed reports on email authentication results.  

Implementing DMARC, along with SPF and DKIM, helps protect your domain from unauthorized use, improves email deliverability, and provides valuable insights into potential abuse.

While DMARC implementation requires careful planning and testing, the long-term benefits of enhanced email security and brand protection make it a worthwhile investment for any organization.