Does DMARC Add Value Beyond Reports?

Question

I set up an email about 1 year ago with Google Suite, in the process I came under the impression that I should set up DMARC. So I did, but now, I'm trying to clean up my inbox and wonder if DMARC is worth keeping. I've never actually reviewed reports.

here is my dmarc record: v=DMARC1; p=quarantine; rua=mailto:myemail@email.com; ruf=mailto:myemail@email.com;

On top of this, I also set this up for a friend with a small business. I'm wondering if I should recommend to them to pay for/learn to use a DMARC service. They would most likely never check the reports and from what I can tell the point of DMARC is to assist in active domain management from an IT department/employee.

This leads me to my questions:

Is DMARC only good for reporting? Or is actually doing something for me? Is it fine to just disable the emails if I'm not actively looking at them?

Answer 1

DMARC is a way to publish your domain sending practices, and the policy you want to apply to unauthorized senders.

In a nutshell, it is a way to stop forged email pretending to come from your domain.

For example, if you own example.net, you can set up DMARC so that an attacker sending a phishing email with a "From" header set to nate@example.net will see the message quarantined or blocked by DMARC-compliant servers, since the attacker's server is not authorized to send those emails.

Is DMARC only good for reporting?

Reporting is a resource to help implement, debug, and monitor DMARC. It is not its ultimate goal.