4

I set up an email about 1 year ago with Google Suite, in the process I came under the impression that I should set up DMARC. So I did, but now, I'm trying to clean up my inbox and wonder if DMARC is worth keeping. I've never actually reviewed reports.

here is my dmarc record: v=DMARC1; p=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected];

On top of this, I also set this up for a friend with a small business. I'm wondering if I should recommend to them to pay for/learn to use a DMARC service. They would most likely never check the reports and from what I can tell the point of DMARC is to assist in active domain management from an IT department/employee.

This leads me to my questions:

Is DMARC only good for reporting? Or is actually doing something for me? Is it fine to just disable the emails if I'm not actively looking at them?

2
  • 2
    FWIW, DMARC is not supposed to be used alone, but with SPF and DKIM. So in order of setup/learning, you should first have SPF installed and running correctly, then DKIM, then DMARC. Commented Jun 1, 2022 at 3:24
  • Does DMARC somehow improve DKIM and SPF? Commented Jun 1, 2022 at 22:03

3 Answers 3

4

DMARC is a way to publish your domain sending practices, and the policy you want to apply to unauthorized senders.

In a nutshell, it is a way to stop forged email pretending to come from your domain.

For example, if you own example.net, you can set up DMARC so that an attacker sending a phishing email with a "From" header set to [email protected] will see the message quarantined or blocked by DMARC-compliant servers, since the attacker's server is not authorized to send those emails.

Is DMARC only good for reporting?

Reporting is a resource to help implement, debug, and monitor DMARC. It is not its ultimate goal.

2

While SPF tells the internet where should your authentic emails originate from (IP addresses)

DKIM tells the internet the digital signature your authentic emails should contain.

The DMARC tells the internet your policy receivers should follow in case the above 2 verifications pass or fail. (and where to report if they fail).

2

DMARC helps to:

  1. Determine how you want email servers to handle validation factors in DKIM and SPF.
  2. Provide an avenue to report others trying to forge emails using your domain.

For example, review the following very strict DMARC record:

v=DMARC1; p=reject; sp=reject; fo=1; aspf=s; adkim=s; pct=100; rua=mailto:[email protected];

Let's review each command:

  • p=reject => Domain policy is to reject mails failing validation. (Policy options are: 1-None 2-Quarantine or 3-Reject)
  • sp=reject => Subdomain policy is also to reject
  • fo=1 => Generate a report for any failure
  • aspf=s => SPF alignment is strict. We don't allow undeclared servers. (options are relaxed(r) or strict(s))
  • adkim=s => DKIM alignment is strict. We don't allow undeclared servers
  • pct=100 => Apply these rules to 100% of emails received (every mail).
  • rua=xxx => Where to send the failure reports

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.