Introduction

DMARC (Domain-based Message Authentication, Reporting & Conformance) is the control system that tells receiving email servers what to do when a message fails SPF or DKIM. Without DMARC, attackers can spoof your domain freely.

---

Section 1 — What DMARC Does

DMARC:

• Protects your domain from spoofing
• Defines how mail servers should handle failures
• Provides visibility into fraud attempts
• Supports brand protection
• Enables full enforcement (“p=reject”)

---

Section 2 — DMARC Tags and Their Meaning

1️⃣ v=DMARC1

Protocol version. Always DMARC1.

2️⃣ p= (Policy)

Tells receiving servers what to do:

• p=none → Monitor only
• p=quarantine → Send failures to spam
• p=reject → Block failures entirely (best practice for banks)

3️⃣ rua= (Aggregate Reports)

Where daily XML reports are delivered.
Example:
rua=mailto:[email protected]

4️⃣ ruf= (Forensic Reports)

Receives detailed failure samples (PII-sensitive).
Example:
ruf=mailto:[email protected]

5️⃣ fo= (Failure Options)

Controls what triggers forensic reporting.
Common:
fo=1 → Send forensic report on any SPF/DKIM failure.

---

Section 3 — Example of a DMARC Record

v=DMARC1;
p=reject;
rua=mailto:[email protected];
ruf=mailto:[email protected];
fo=1;
adkim=s;
aspf=s;

adkim=s and aspf=s enforce strict alignment — critical for banks and regulated industries.

---

Section 4 — Why DMARC Matters

• Blocks domain impersonation
• Reduces malware/phishing impact
• Protects customers from fraud
• Shields executives from spoofing
• Enables brand trust
• Essential for financial institutions

---

Conclusion

A strong DMARC policy (“reject”) is one of the strongest defenses against email spoofing — but only when SPF and DKIM are configured properly and regularly monitored.

---

© 2012–2025 Jet Mariano. All rights reserved.
For usage terms, please see the Legal Disclaimer.