Table of Contents
- What is DMARC and Why It Matters
- SPF, DKIM, and DMARC: How They Work Together
- DMARC DNS Record Structure
- Policy Levels: none, quarantine, reject
- Step-by-Step DMARC Setup
- Understanding DMARC Reports
- DMARC for Subdomains
- Common Mistakes and How to Fix Them
- Verifying Your DMARC Configuration
- Frequently Asked Questions
What is DMARC and Why It Matters
DMARC stands for Domain-based Message Authentication, Reporting & Conformance. It is an international email authentication standard that allows domain owners to specify what should happen to emails claiming to be from their domain when they fail authentication checks.
Email spoofing is when an attacker sends emails with a forged sender address (From header) that appears to come from a trusted domain — such as [email protected] — even though they have no authority over that domain. DMARC gives receiving mail servers a way to detect and reject such forged emails.
SPF, DKIM, and DMARC: How They Work Together
To understand DMARC, you need to know the basics of SPF and DKIM first:
| Standard | Function | DNS Record | What It Verifies |
|---|---|---|---|
| SPF | Lists authorized IP addresses for sending email | TXT (v=spf1...) | Mail server IP address |
| DKIM | Adds a cryptographic signature to emails | TXT (selector._domainkey) | Digital signature validity |
| DMARC | Defines policy and receives reports | TXT (_dmarc) | Alignment + Policy enforcement |
DMARC does not replace SPF or DKIM — it builds on them. DMARC checks alignment: whether the domain in the From header matches the domain that passed SPF or DKIM authentication.
DMARC DNS Record Structure
A DMARC record is a TXT record created at the _dmarc subdomain of your domain. For example:
_dmarc.yourcompany.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]; fo=1"Explanation of each tag:
| Tag | Meaning | Example Value |
|---|---|---|
v | Version (required) | DMARC1 |
p | Policy for the root domain (required) | none / quarantine / reject |
sp | Policy for subdomains | none / quarantine / reject |
rua | Address for aggregate reports | mailto:[email protected] |
ruf | Address for forensic reports | mailto:[email protected] |
pct | Percentage of emails to apply policy to | 100 (default) |
adkim | DKIM alignment mode | r (relaxed) / s (strict) |
aspf | SPF alignment mode | r (relaxed) / s (strict) |
fo | Failure reporting options | 0 / 1 / d / s |
Policy Levels: none, quarantine, reject
The p= value is the heart of DMARC. There are 3 levels:
1 p=none — Monitor Mode
Emails that fail DMARC are still delivered normally, but you receive reports. Ideal for beginners or initial testing — use it to collect data before increasing enforcement.
2 p=quarantine — Quarantine Mode
Emails that fail DMARC are sent to the spam/junk folder instead of the inbox. Suitable when 70-80% confident that SPF and DKIM are correctly configured for all legitimate senders.
3 p=reject — Full Rejection
Emails that fail DMARC are rejected outright. Senders receive a bounce-back message. Use when 100% confident that all legitimate email passes authentication.
Step-by-Step DMARC Setup
1 Verify Your SPF Record Exists
dig TXT yourdomain.com | grep spfExpected result: "v=spf1 include:mail.yourdomain.com ~all"
2 Verify Your DKIM Record Exists
dig TXT default._domainkey.yourdomain.comFor AsiaGB Hosting users (DirectAdmin): DKIM is automatically configured when email hosting is activated.
3 Create Your DMARC Record
In your domain's DNS manager, create a TXT record:
| Field | Value |
|---|---|
| Type | TXT |
| Host/Name | _dmarc |
| Value | v=DMARC1; p=none; rua=mailto:[email protected] |
| TTL | 3600 |
4 Wait for DNS Propagation (24-48 hours)
After creating the record, DNS propagation typically takes 1-24 hours to complete globally.
5 Review Reports and Increase Policy
After collecting reports for 2-4 weeks, analyze whether any legitimate emails are failing. Then gradually increase to quarantine → reject.
Understanding DMARC Reports
DMARC generates two types of reports:
| Type | Tag | Frequency | Content |
|---|---|---|---|
| Aggregate Report | rua= | Daily | Statistical summary of SPF/DKIM pass/fail results |
| Forensic Report | ruf= | Per failure | Copy of individual failing emails (not all providers send these) |
Reports arrive as XML files. Recommended tools to parse and visualize them:
- MXToolbox DMARC Analyzer — Free, easy to use
- dmarcanalyzer.com — Free tier available
- Postmark DMARC — Free for small domains
DMARC for Subdomains
To set a different policy for subdomains, use the sp= tag:
"v=DMARC1; p=reject; sp=quarantine; rua=mailto:[email protected]"In this example, the root domain uses reject while all subdomains use quarantine — useful when some subdomains haven't had DKIM configured yet.
Common Mistakes and How to Fix Them
| Mistake | Cause | Fix |
|---|---|---|
| DMARC set but spam still gets through | Using p=none (monitor mode only) | Switch to p=quarantine or p=reject |
| Legitimate emails getting rejected | SPF/DKIM doesn't cover all email services | Check aggregate reports and add missing SPF includes |
| Not receiving DMARC reports | Invalid rua= address or full mailbox | Verify destination email and DNS syntax |
| Invalid DMARC record | Whitespace or syntax error | Use MXToolbox DMARC checker |
| Alignment failing despite SPF pass | Mail From domain ≠ From header domain | Use aspf=r (relaxed) or fix Mail From address |
Verifying Your DMARC Configuration
dig TXT _dmarc.yourdomain.com
# Expected output:
_dmarc.yourdomain.com. 3600 IN TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"Or use online tools:
- mxtoolbox.com/dmarc — Check and analyze your DMARC record
- mail-tester.com — Send a real test email and see DMARC results
- Google Postmaster Tools — View your domain's reputation in Gmail