GlossaryEmail
DMARC
Definition
DMARC is a TXT record published on a domain's “_dmarc” name. It requires the address shown to the recipient to match what SPF or DKIM validated, tells the receiving server what to do with messages that fail, and asks for reports.
SPF and DKIM observe, DMARC decides
Without DMARC, a server receiving a message that fails both checks does whatever it judges best, and that judgement differs from one provider to the next. With DMARC you dictate it: let it through, quarantine it, or refuse it. In exchange you get a daily report of everything sent in your domain's name — including by people with no right to it.
It is also the only one of the three that protects the address your recipient actually sees. SPF checks the envelope address, DKIM checks the message; DMARC requires one of them to align with the visible domain name. Without it, anyone can display any sender and still pass both checks.
A deployment record
A quarantine policy, a reporting address, and relaxed alignment.
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; adkim=r; aspf=r"“p” is the instruction: “none” discards nothing and is there to observe, “quarantine” sets aside, “reject” refuses. “rua” is the address that receives the daily reports, and it is what makes a deployment possible at all — it shows you who is sending before you tighten anything.
The usual mistake
Publishing “p=reject” on day one, because it is the most protective value. The invoices from the accounting tool, the messages from the site's contact form and the newsletter all stop arriving, and it takes weeks to work out what changed.
How to avoid it: Start at “p=none” with a reporting address, read the reports for a few weeks, authorize everything legitimate you discover, then move to quarantine and only after that to reject. The staircase takes a month and breaks nothing.
Where the sources disagree: A revision of the standard, known as DMARCbis, has been circulating at the IETF and changes several points, including how the parent domain is determined. Depending on the source, it is described as still in publication or as already published. What is certain: a record written to RFC 7489 is still read everywhere.
Source: DMARC is defined in RFC 7489: the “_dmarc” name, the tags and their default values, and the alignment rules for SPF and DKIM.
Related terms
Where to go next
Knowing the words is half the job
The other half is knowing which of your domains is about to become a problem. DomainVigil watches expiry, DNS, certificates and reputation, and tells you before your client does.
Start for freeFive domains free, forever. No card required.