Creating a DMARC policy

This article explains what DMARC is and how it can help validate your emails to protect against fraudulent activity.

What is DMARC?

Domain-based Message Authentication, Reporting, and Conformance (DMARC) is an inbound email policy built on top of DKIM and SPF records, designed to detect and prevent fraudulent emails.

When you add a DMARC policy to your domain, you choose to inform the recipient that your emails are protected by DKIM and/or SPF records and what to do if your DMARC policy fails alignment with those records.

Example of the DMARC validation process

1. The sender adds a DMARC policy to their domain.
2. The sender sends an email.
3. The recipient's email server checks if the email contains a DMARC policy.
4. The recipient's email server checks if the DKIM/SPF records mentioned in the sender's DMARC policy are valid.
5. The recipient's email server checks if the valid DKIM/SPF records also pass something called 'alignment'.
   • If 'alignment' is passed, the email is received.
   • If 'alignment' is not passed (even if DKIM/SPF checks are passed), then the message fails.

This process of validation helps to ensure that fraudulent activity appearing to come from the domain is blocked.

The following steps explain how to configure a DMARC policy on your domain.

 

Create report emails

Create two separate email addresses to receive DMARC daily aggregate and forensic reports. It’s recommended you create two email addresses since you may receive a large number of reports. For example:

• dmarc_agg@example.com
• dmarc_forensic@example.com

Create DKIM and SPF records

Configure a DKIM and/or SPF record on your domain. It's recommended that you enable both records to take full advantage of the DMARC policy. See the following articles for more information:

• DKIM records
• SPF overview
• Add an SPF record

Add the DMARC record in the panel

1. Navigate to the Manage Websites page.
2. Click the Manage button to open the Domain Settings page, which allows you to adjust various settings for your site.
   • If in Grid view, click the Manage button at the bottom of the website box.
   • If in List view, click the Manage button at the far right of your domain name.

   

3. Click the DNS tab.
4. Click the Add Record button.
5. Hover over the TXT Record section and click the ADD link.

   

6. Enter the following:
   • Host: _dmarc
   • TXT Value *: Below is a basic configuration that handles the majority of your DMARC needs. Just make sure to adjust the email addresses to the addresses you created above to receive incoming reports.

     v=DMARC1; p=quarantine; fo=1; rua=mailto:dmarc_agg@example.com;ruf=mailto:dmarc_forensic@example.com;pct=100

     View the 'DMARC Tags' section below for further details on the different options you can use.

7. Click the Add Record button to save.

After clicking the Add Record button, DNS propagation begins for the new record. It can take up to 6 hours before the new record to update online.

The DMARC policy checks the domain name listed in the message's From: field. It then compares that domain to other authenticated domain names listed in the email's header.

• If they are identical, your DMARC policy is aligned.
• If not, you should contact your email host and ask for instructions on ensuring your records are aligned.

Strict and relaxed alignment

The alignment in your policy can be set as strict or relaxed:

• Strict alignment: the domains must be identical
• Relaxed alignment: the top-level 'Organizational Domain' must match

The 'Organizational Domain' is your domain name, followed by its suffix. For example:

• example.com
• example.net
• example.com.au

The sender's DMARC policy contains report email addresses (set in the rua and ruf tags) to handle emails that fail authentication. Two types of reports can be created:

• Aggregate reports: These reports are sent in XML format once a day which consists of aggregate data of all DMARC failures. This email address is set with the rua tag.
• Forensic reports (aka failure reports): These reports are generated immediately and consist of individual emails that failed. This email address is set with the ruf tag.

Analyzing the reports

You can use a tool like the following to analyze your reports:

• DMARC Report Analyzer

Testing received emails for alignment

The following steps check received email headers to confirm if they will pass alignment:

1. Send an email to yourself (or another address you own).
2. View the received email's headers.
3. Verify domain alignment by identifying the domain listed as the sending address. It may be located in the following places:

   Field	Example
   The Envelope From domain	From: admin@example.com
   The Return-Path	<admin@example.com>
   The d=domain in the DKIM-Signature	DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=example.com;

   The domains mentioned in all of these areas must be identical, otherwise, DMARC will fail alignment.

DMARC records use tags to define how the DMARC record should be implemented. Of the 11 tags available, only 2 are required, but others are recommended. View the information below for further details.