What is DMARC and how do I use it?
DMARC is a protocol used to detect fraudulent messages being sent from your domain name and prevent them being delivered to recipients inboxes.
What is DMARC?
- DMARC, stands for "Domain-based Message Authentication, Reporting & Conformance"
- Its purpose is to detect phishing, spoofed or fraudulent emails being sent from your domain and prevent them from being delivered.
- It also provides the functionality for email providers to report back to you about messages that pass or fail your authentication policies.
Is DMARC required to authorise a domain with AuthSMTP?
Before a customer-owned sending domain can be authorised, it must publish a valid SPF record covering AuthSMTP, publish a valid DMARC record, and have AuthSMTP DKIM signing configured and verified. p=none is acceptable as a starting monitoring policy; you do not need to begin with p=quarantine or p=reject. The longer-term plan should be to review DMARC reports, correct authentication and alignment for every legitimate sender, then progress to p=quarantine and ultimately p=reject.
DMARC technically passes when at least one supported authentication method passes and aligns with the visible From domain. AuthSMTP deliberately requires valid SPF, verified domain-specific DKIM and the DMARC record. Authentication expectations at mailbox providers continue to become stricter, and customers may already send—or later grow to send—high volumes of email.
DKIM provides a cryptographic signature that helps recipients verify genuine messages and detect changes to signed content. DMARC connects that authentication to the visible From domain and provides reporting and policy controls. Together they improve trust in legitimate mail and reduce the risk of successful spoofing or impersonation using your domain.
What are the requirements to use DMARC?
- You must be sending the emails from your own domain name(s).
- Your envelope email address, header email address and DKIM signing domain name should be the same (‘aligned’).
- You must have one valid SPF record on your domain name, correctly configured for AuthSMTP and all other possible sources of email for your domain name.
- You must have AuthSMTP DKIM signing setup, verified and enabled for mail sent through AuthSMTP.
How do I use DMARC?
The core element of DMARC is your DMARC policy which has to be published in the DNS records of your domain name.
What is a DMARC policy?
Generally speaking, a DMARC policy is a set of instructions that tells inbound email providers how to handle the authentication of messages sent from your domain name and what to do if a message fails the authentication checks.
Technical speaking, a DMARC policy is a DNS TXT record published on the '_dmarc.example.com' sub domain name and consists of a number of different elements.
A DMARC policy typically looks something like this:
"v=DMARC1; p=none; sp=reject; pct=100; rua=mailto:[email protected];"
| Element | Value | Explanation |
|---|---|---|
| v= | DMARC1 | The version of the DMARC protocol to use. |
| p= | none | The policy to apply to messages that fail sender verification. In this case, the policy is set to 'none' so the email provider will fall back to their own default policies based on the results of the SPF and DKIM check. |
| sp= | quarantine | Not recommended - some providers no longer support. The policy to apply to messages sent from a sub domain name that fail sender verification. In this case, the policy is set to 'quarantine' so messages sent from a sub domain name that fail sender verification must be quarantined (i.e. filtered to the spam folder). |
| pct= | 100 | The percentage of emails that fail sender verification on which to apply the policy. In this case it is set to '100' so all emails that fail sender verification should have the declared policy applied to them. |
| rua=mailto: | [email protected] | The email address to send aggregated reports to explaining how many messages failed or passed sender verification and why. |
| Element | Required? | Value | Explanation |
|---|---|---|---|
| v= | Yes | DMARC1 | The version of the DMARC protocol to use, there are currently no other options. |
| p= | Yes | The policy to apply to messages that fail sender verification (SPF / DKIM) | |
| none | This indicates to the inbound email provider that they should just default to their own policies. Normally used for testing or reporting only | ||
| quarantine | This indicates to the inbound email provider that they should quarantine any messages that fail sender verification (SPF / DKIM). To 'quarantine', typically means to move the message to the spam / junk folder. | ||
| reject | This indicates to the inbound email provider that they should outright reject any messages that fail sender verification (SPF / DKIM). This will generally result in a non-delivery report being sent back to the sender. | ||
| sp= | Optional | This is the same as the 'p=' element but it is the policy to apply to messages sent from sub domain names. For example - the 'p=' policy would apply to messages sent from '[email protected]', the 'sp=' policy would apply to messages sent from '[email protected]' | |
| none | This indicates to the inbound email provider that they should just default to their own policies. Normally used for testing or reporting only. | ||
| quarantine | This indicates to the inbound email provider that they should quarantine any messages that fail sender verification (SPF / DKIM). To 'quarantine', typically means to move the message to the spam / junk folder. | ||
| reject | This indicates to the inbound email provider that they should outright reject any messages that fail sender verification (SPF / DKIM). This will generally result in a non-delivery report being sent back to the sender. | ||
| pct= | Optional | Integer between 1 and 100 | This is a number between 0 and 100 and indicates to the inbound email provider what percentage of your messages (that fail sender verification) to apply your policies to. Normally this would be set to 100 so that your policies are applied to all emails sent from your domain name. If you are just starting with DMARC you can set this to a lower number to limit the damage of any misconfigurations with your SPF / DKIM records. |
| rua=mailto: | Optional | Any valid email address | This is the address that aggregated feedback reports are sent to showing stats of how many messages have passed and failed sender verification. |
| ruf=mailto: | Optional | Any valid email address | This is the address that specific message failure reports are sent to detailing why a message did not pass sender verification. |
What DMARC policy should I use?
It is difficult for us to answer this question for you, it depends on how complex your email configuration is and how confident you are that your SPF and DKIM records are configured correctly.
If you confident that your SPF and DKIM records are configured correctly for all your mail sources we would recommend the following record which is strict and fully enforces your SPF / DKIM records but you will be notified of any failures:
"v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:[email protected];"
If you are unsure, we would recommend the following record which will not affect any of your email delivery (unless the providers default policies override), it will only report on failures:
"v=DMARC1; p=none; sp=none; pct=100; rua=mailto:[email protected];"
Treat p=none as the monitoring stage, not the permanent destination. Review the reports until every legitimate source is authenticated and aligned, then introduce p=quarantine carefully before moving to p=reject.
How do I setup my DMARC policy?
You will need to publish your DMARC policy as a TXT record on the '_dmarc' subdomain in your domain's DNS records.
_dmarc.example.com IN TXT "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:[email protected];"
If you are unsure how to edit your domain's DNS records, please contact your IT department or domain name provider.
How can I test my DMARC / SPF / DKIM configuration?
- SPF
- Our control panel will show your current SPF record and whether it is configured correctly for use with our network but it will not advise you on other potential issues or if it covers all of your email sources.
- DKIM
- DKIM is configured per sending domain and outbound email provider. You can view and edit the domain-specific configuration for messages sent via our network in the AuthSMTP Control Panel. For new AuthSMTP configurations, follow the recommended DKIM CNAME setup guide.
- It is not possible for us to advise you on the DKIM configuration for messages sent via other networks.
- DMARC
- You can test if the DNS record is setup correctly by using a DNS tool to lookup the 'TXT' records on '_dmarc.example.com'.
- If your DMARC record is configured correctly you should begin receiving aggregated DMARC reports within a couple of weeks hours.
Where can I get more information on DMARC?
We would recommend that you visit the official DMARC website or see the DMARC RFC 7489.