What Is a DMARC Record? A Simple Guide With Examples…

Did you know that people may receive emails that appear as if they’ve come from your organization, even if you never sent them? According to Statista, the number of emails sent daily will exceed 400 billion by 2027, but a large portion of these messages are unlikely to be delivered as intended. Many will be falsified and tampered with unless email authentication protocols are implemented.

If you’ve ever wondered how companies can protect their emails from being hijacked or used for malicious purposes, the answer you’re looking for is DMARC (Domain-based Message Authentication, Reporting, and Conformance). A DMARC record is an auxiliary security configuration that can be a difference-maker in the battle between legitimate senders and threat actors. It serves as a reliable mechanism to deal with rogue emails and stave off spoofing and other email-based threats.

Follow along as we show you the intricacies of DMARC records and break down what they are used for, what they look like, and how you can set one up for your domain. By the end, you’ll have clear instructions and knowledge to improve your domain’s security and ensure your recipients are not taken for a ride.

What Does a DMARC Record Do?

A DMARC record is a machine-readable set of instructions embedded within a TXT DNS (Domain Name System) record. These instructions are intended for receiving email servers so that proper action can be taken when certain emails have signs of malicious activity, like if they fail to pass authentication checks.

At this point, you may already have SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) protocols. DMARC makes sure messages can’t slip through the DKIM and SPF cracks to repel impersonation attempts.

DMARC empowers you to lay down what action should be taken when an email misses the SPF or DKIM mark:

• Allow. This option means the message will be accepted regardless of the SPF and DKIM results. It will be delivered to the recipient’s inbox, even if the potential signs of malicious activity have been detected. That’s why it is a no-go option for high-security environments.
• Reject. This is the strictest action that is recommended for complete DMARC deployment. It instructs receiving servers to block the incoming message if it doesn’t pass the authentication checks.
• Quarantine. Quarantining an email is a way to avoid extremes. It allows for the delivery of a message but isolates it from the recipient’s main inbox so that you can check for false positives and verify email legitimacy.

With a DNS DMARC record and an accurately specified action, receiving servers know what to do when they encounter an email that doesn’t meet the authentication standards. The several options for the desired action will enable you to align this protocol with your email security needs.

What Does a DMARC Record Look Like?

A standard DMARC record consists of several components, known as tags and values, formatted as text. Take a closer look at this example:

v=DMARC1; p=reject; rua=mailto:testingreports@yourdomain.com; ruf=mailto:dmarc-failures@yourdomain.com; aspf=s; adkim=s;

Looks like a foreign language to you? Let us explain the values and tags in this example:

• v=DMARC1 specifies the version of the DMARC protocol being used. All DMARC records must start with the v tag.
• p=reject refers to the DMARC policy that instructs receiving servers to block (reject) emails with validation issues. The p tag must always follow the v tag. Depending on your needs, you can change the reject value to none (green-lighting the delivery of all messages) or quarantine (isolating suspicious messages).
• rua=mailto:testingreports@yourdomain.com points out an email address where you will receive aggregate DMARC reports. It’s a good idea to create a dedicated mailbox for the reports because there may be too many.
• ruf=mailto:dmarc-failures@yourdomain.com specifies an email address where you will get forensic reports. You can learn the difference between forensic and aggregate reports and the benefits of regularly analyzing them in our previous blog.
• aspf=s defines a strict relationship between DMARC and SPF protocols. Alternatively, you can set the value to r, which stands for relaxed.
• adkim=s similarly defines a strict relationship between DMARC and DKIM. You can also use the r value here if you want more flexibility for subdomains to get through.

Keep in mind that this is just a DMARC record example, which may work for some organizations. Others may want to add more or fewer tags to fine-tune their email traffic verification processes. Only v and p tags are must-haves in all records, meaning it’s up to you to use or remove other tags.

The order of the v and p tags is important, and you can’t experiment here. On top of that, improper formatting can cause a DNS DMARC record to be ignored or not function as intended.

The most secure mailbox environment can be created with the p=reject policy and strict alignment criteria for all the validation standards. To boost security, you can also specify that 100% of your emails must be filtered before delivery using the pct tag.

For testing DMARC and how far you should get with enforcement, set your policy to p=none. This will let you receive reports on the validation results and possible issues without keeping your messages out of the recipient’s inbox.

Your Brief DMARC Setup Guide

You can copy or write down those tags and values manually using any text editor you are familiar with or have a DMARC record generated for you. There are many online generators that can provide you with a publish-ready TXT file.

To set up DMARC and rest assured that your authentication protocols work like a well-oiled machine, you should:

1. Go back to SPF and DKIM. For the best validation results, both protocols should be enabled on your domain before DMARC setup. Without configuring DKIM and SPF, you may encounter serious deliverability problems.
2. Consider monitoring convenience. As mentioned above, DMARC reports may inundate your inbox, especially if you send emails galore and have specified the same address in the rua and ruf tags for all your domains and subdomains. A separate mailbox for receiving and scrutinizing reports can be a great help.
3. Publish the record with your DNS host. Double-check the formatting of your record and whether it includes all the required tags and values for a well-defined policy. Then, go to DNS Settings, find the Records section, and add the manually written or generated TXT record. Save the changes and repeat the setup process for all the domains you manage.

If you have difficulty generating your record, finding your DNS Settings, or verifying whether they have been properly updated, our technical support team can lend a helping hand.

Can You Have More Than One DMARC Record?

You can put different policies to the test by creating different DMARC records, but only one must be enabled per domain at the same time. Adding several records to your DNS will baffle receiving servers and lead to incorrect email validation and enforcement, just like a poorly formatted DMARC record.

You can only have more than one record if you use multiple domains and subdomains with non-overlapping security requirements. If this is the case, each may require its own set of email handling instructions.

How to Check a DMARC Record

Checking whether you have successfully deployed DMARC according to your policy requirements has never been easier. Simply use this free tool for record lookup for any domain to verify the presence of the record and validate its configuration. Plus, it allows you to run SPF and BIMI (Brand Indicators for Message Identification) checks.

If you don’t see a DNS DMARC record, make sure there are no typos or unnecessary spacing in your domain name. If nothing shows up anyway, you might have made errors in the record or during the setup process. Contact Spambrella for assistance.