Email Authentication: Understanding DMARC

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a technical standard that helps protect your domain from being used for email spoofing and phishing attacks. It works by building upon two other email authentication methods: SPF and DKIM. DMARC allows you, as the domain owner, to specify a policy for how receiving mail servers should handle emails that fail authentication checks. This policy can instruct servers to either monitor, quarantine, or outright reject unauthenticated messages.

DMARC Policy Levels

Your DMARC policy is defined by the p tag in your DNS record. There are three primary policy levels:

• p=none: This is a monitoring-only policy. Emails that fail DMARC checks are still delivered, but you will receive reports about the failures. This is the recommended starting point when first implementing DMARC.
• p=quarantine: Emails that fail authentication are not delivered to the recipient's primary inbox. Instead, they are typically directed to the spam or junk folder.
• p=reject: This is the strongest policy. Emails that fail DMARC authentication are blocked and not delivered at all. This is the recommended policy for maximum security once you are confident your legitimate emails are passing authentication.

Configuring a DMARC Record

A DMARC record is a specific type of TXT record that you add to your domain's DNS settings. The record must be named _dmarc.yourdomain.com.

The simplest valid DMARC record contains two required tags:

• v=DMARC1: This specifies the DMARC version and must always be present.
• p=none: This defines your policy, as described above.

For example, a basic record looks like this: v=DMARC1; p=none;

You can add other optional tags to your record for more granular control, such as specifying an email address to receive aggregate reports (rua) or setting alignment modes for SPF and DKIM checks.

How DMARC Authentication Works

When an email is sent, the receiving mail server performs a series of checks:

1. Authentication Check: The server verifies the email using SPF and/or DKIM.
2. Alignment Check: The server checks if the domain used in the SPF or DKIM authentication aligns with the domain visible in the email's "From" address.
3. Policy Enforcement: The server retrieves the DMARC policy from the "From" domain's DNS and applies the specified action (none, quarantine, or reject) based on the results of the authentication and alignment checks.

DMARC and Shared Sending Domains

If you send emails through your CRM using a shared sending domain (for example, if you have not configured your own custom domain for sending), DMARC is not required for your emails to be sent successfully.

However, if the domain in your "From" email address has a strict DMARC policy (such as p=reject), you may encounter delivery errors. This is because the email is technically being sent from the shared domain, which may not align with your "From" domain, causing the DMARC check to fail. To ensure optimal deliverability, it is recommended to set up a custom authenticated domain for sending emails from your CRM.