How Does DMARC Work?
How Does DMARC Work? Learn the technical specification of DMARC and how a DMARC policy works Get a Quote Download Datasheet Email Security > DMARC How Does DMARC Work? Email communication is a crucial aspect of daily operations when you run an organisation. You and your team exchange emails daily, which may contain sensitive information that could be compromised by various risks. Therefore, the security of your email communication becomes crucial. By Cian Fitzpatrick | 3 August, 2023 Taking the necessary measures to safeguard your email communication will help protect your organisation’s valuable data and maintain your stakeholders’ trust. Hence, DMARC services (Domain-based Message Authentication, Reporting, and Conformance) play a powerful solution to enhance your organisation’s email security. What is DMARC in email? DMARC stands for Domain-based Message Authentication Reporting & Conformance, a security protocol used to authenticate an email. It protects domain owners from spam, phishing, and other email scams that can happen through email. It combines two essential components such as SPF (Sender Policy Framework) and DKIM (Domain Keys Identified Mail), that provide a framework to verify the authenticity of incoming email messages. Take a look at our comprehensive DMARC guide to get all the necessary information. What Are SPF, DNS and DKIM? Through SPF (Sender Policy Framework), you can specify which IP addresses can send emails from your domain. When an email is received, the receiving email server checks the SPF record to verify if the sender’s IP address is authorised to send emails for that particular domain. If the email fails the SPF check, it is considered potentially fraudulent. “DNS (Domain Name System) acts as a phonebook for the internet. When you type a domain name like “example.com” into your web browser, the DNS system translates that domain name into the corresponding IP address (such as 192.0.2.1) that identifies the server where the website is hosted. “ DKIM (Domain Keys Identified Mail) is an email authentication method that adds an extra layer of security by digitally signing outgoing emails with a private key and attaching the signature to the email headers. The recipient’s server then uses the public key published in the DNS to verify the authenticity and integrity of the email. This ensures that the message originated from the authorised domain. However, SPF and DKIM alone cannot fully protect against email fraud. This is where DMARC plays an important role. It builds upon SPF and DKIM to provide a comprehensive framework for email authentication and policy enforcement. Get Your Policy=Reject Contact Topsec today Get Quote The Link Between DMARC, SPF, and DKIM in Email Authentication DMARC, SPF, and DKIM work together to authenticate emails and prevent fraudulent activities. SPF helps verify the sender’s IP address. DKIM verifies the integrity and authenticity of the email, and DMARC allows domain owners to set policies and receive reports on email authentication. Together, these protocols prevent email fraud, phishing, and spoofing attacks, providing more secure email communication. Technical Specifications of DMARC DMARC is a flexible protocol that domain owners can customise based on their needs. The technical specifications of DMARC are as follows: DMARC Record A DMARC record is a simple text file that stores a domain’s DMARC policy. It instructs email receivers on what actions to take when an email fails DMARC authentication and where to send reports. The DMARC record includes various parameters, such as the chosen DMARC policy, which determines how emails that fail DMARC validation are handled. Policy Modes DMARC allows domain owners to specify different policy modes if an email fails the SPF or DKIM process. There are three different policy modes, such as “None,” “Quarantine,” and “Reject.” Alignment Two alignment checks known as SPF Alignment and DKIM Alignment ensure the “From” header domains match the authenticated domains used in SPF and DKIM. Reporting DMARC sends reports to domain owners known as “Aggregate Reports” and “Failure Reports”. These reports provide SPM and DKIM statistics, alignment results, sending sources, and more. Subdomain Policy DMARC allows domain owners to specify separate policies for subdomains to enable control over email authentication for different subdomains. DMARC Tag-Value Syntax DMARC uses a specific syntax to provide instructions or information. The common tags used in DMARC records include “v” for protocol version, “p” for policy, “rua” for aggregate report addresses, “ruf” for failure report addresses, and “sp” for subdomain policies. Contact Us to implement your DMARC Policy Call Us Now How Does DMARC Work? DMARC offers domain owners and organisations a framework to specify how email receivers should handle unauthenticated emails that claim to come from their domain. It helps to ensure the safety and security of email communication. Here’s a step-by-step explanation of how DMARC works: Setting up DMARC Record: The domain owners add DMARC records to the DNS zone file. The record includes the DMARC policy for the domain and provides instructions to email receivers on handling incoming emails from that domain. Incoming Email: When receiving an email, the server checks whether the DMARC record is in the sender’s domain DNS. SPF and DKIM Checks: The recipient’s email server then performs SPF and DKIM checks for the email’s authenticity. SPF validates the sender’s IP address, while DKIM verifies the digital signature associated with the email. DMARC Alignment: Once the SPF and DKIM checks are completed, DMARC checks if the “From” header domain matches the domain authorised in the SPF and DKIM checks. The DMARC alignment ensures the email is sent from an authorised sender and hasn’t been spoofed. DMARC Policy Evaluation: The recipient’s email server evaluates the SPF and DKIM results based on the specified DMARC policy. There are three types of DMARC policies: None Policy (“p=none”): In the None policy, no specific action is taken on unauthenticated emails. However, reports are still generated and sent to the domain owner for monitoring. Quarantine Policy (“p=quarantine”): Under Quarantine policy, an email that fails authentication is considered suspicious and placed in the recipient’s spam or quarantine folder. Reject Policy (“p=reject”): When the Reject policy is specified, all
