What Is DMARC?

DMARC, which stands for Domain-based Message Authentication, Reporting and Conformance, is an open email authentication protocol that provides domain-level protection of the email channel. DMARC authentication detects and prevents email spoofing techniques used in phishing, business email compromise (BEC), and other email-based attacks.

Building on existing standards—Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM)—DMARC is the first and only widely deployed technology that can make the header “from” domain trustworthy. The domain owner can publish a DMARC record in the Domain Name System (DNS) and create a policy to tell receivers what to do with emails that fail authentication.

With DMARC, domain owners can effectively outline their authentication practices and determine specific actions that can be taken when an email fails authentication. This powerful email authentication protocol helps domain owners combat a host of security threats.

Examples

• Domain spoofing: An attacker spoofs a company’s domain to make an email seem legitimate.
• Email spoofing: A term for spoofing activities involving email.
• Business email compromise (BEC): An email that appears to come from a senior employee within an organisation requesting that money or sensitive information be sent.
• Impostor email: A spoofed email sent by an impostor claiming to be someone they are not.
• Email phishing: An email that tries to get victims to install malware or offer their credentials. A phishing email often looks like a familiar brand to appear legitimate.
• Consumer phishing: Spoofed email sent to a consumer of a company claiming to be from that company intending to steal credentials.
• Partner spoofing: Business-based spoofed email between supply chain partners requesting to change payment details to siphon money.
• Whaling email scam: Fraudulent email sent to a senior employee within an organisation aiming to get a large financial gain.

Standards

• Domain-based Message Authentication Reporting and Conformance (DMARC): An email validation system that detects and prevents email spoofing. It helps combat certain techniques often used in phishing and email spam, such as emails with forged sender addresses that appear to come from legitimate organisations.
• Sender Policy Framework (SPF): An email validation protocol detecting and blocking email. It allows receiving mail exchangers to verify that incoming mail from a domain comes from an IP address authorised by its administrators.
• DomainKeys Identified Mail (DKIM): An email authentication method that detects email spoofing. It allows the receiver to check that an email claiming to come from a specific domain was authorised by its owner.
• Binding Operational Directive 18-01: The Department of Homeland Security has issued Binding Operational Directive 18-01 for agencies to upgrade their email and web security. Agencies will need to implement SPF, DMARC, and STARTTLS efficiently.

SPF and DKIM are the two primary authentication mechanisms that play a crucial role in DMARC. Each is based on unique records that help confirm the legitimacy of emails.

Sender Policy Framework (SPF) is an email validation protocol that allows an organisation to specify who can send emails from their domains. Organisations can authorise senders within an SPF record published in the Domain Name System (DNS). This record includes the approved IP addresses of email senders, including the IP addresses of service providers authorised to send emails on the organisation’s behalf. Publishing and checking SPF records is a reliable way to stop phishing and other email-based threats that forge “from” addresses and domains.

Domain Keys Identified Mail (DKIM) is an email authentication protocol that allows the receiver to check that an email from a specific domain was authorised by its owner. It enables an organisation to take responsibility for transmitting a message by attaching a digital signature. Verification is done through cryptographic authentication using the signer’s public key published in the DNS. The signature ensures that parts of the email have not been modified since attaching the digital signature.

Both SPF and DKIM help establish email authenticity and prevent common email security threats, like spoofing and phishing attacks. In the context of DMARC, these authentication mechanisms are used in conjunction to validate the sender’s identity. The DMARC policy, published as a DNS record, instructs recipient servers on how to handle emails that fail SPF or DKIM checks. By combining SPF and DKIM results with a DMARC policy, domain owners can specify whether to quarantine or reject emails that fail authentication, allowing better control over email delivery and reducing the risk of fraudulent emails attempting to hijack their domain name.

For a message to pass DMARC authentication, it must pass SPF authentication and SPF alignment and/or pass DKIM authentication and DKIM alignment. If a message fails DMARC, senders can instruct receivers on what to do with that message via a DMARC policy. There are three DMARC policies the domain owner can enforce: none (the message is delivered to the recipient, and the DMARC report is sent to the domain owner), quarantine (the message is moved to a quarantine folder) and reject (the message is not delivered at all).

The DMARC policy of “none” is a good first step. This way, the domain owner can ensure that all legitimate emails authenticate properly. The domain owner receives DMARC reports to help ensure that all legitimate email is identified and passes authentication. Once the domain owner is confident they have identified all legitimate senders and have fixed authentication issues, they can move to a policy of “reject” and block phishing, business email compromise, and other email fraud attacks. As an email receiver, an organisation can ensure that its secure email gateway enforces the DMARC policy implemented by the domain owner. This will protect employees against inbound email threats.

SPF authentication starts by identifying all legitimate IP addresses that should send email from a given domain and then publishes this list in the DNS. Before delivering a message, email providers verify the SPF record by looking up the domain included in the “envelope from” address within the hidden technical header of the email. If the IP address sending an email on behalf of this domain is not listed in the domain’s SPF record, the message fails SPF authentication.

For DKIM authentication, the sender first identifies what fields they want to include in their DKIM signature, such as the “from” address, the body of the email, the subject, and more. These fields must remain unchanged in transit, or the message will fail DKIM authentication. The sender’s email platform will create a hash of the text fields included in the DKIM signature. Once the hash string is generated, it is encrypted with a private key only the sender can access. After the email is sent, it’s up to the email gateway or consumer mailbox provider to validate the DKIM signature by locating a public key that matches the private key. Then the DKIM signature is decrypted back to its original hash string.

DMARC provides several benefits in reinforcing email-based cybersecurity measures for organisations that implement it. Some of the core advantages of leveraging DMARC include:

• Improves email deliverability: Setting a DMARC record in your DNS settings can improve overall email deliverability while preventing threat actors from delivering malicious emails using your domain.
• Lowers the risk of email phishing attacks: DMARC effectively prevents and mitigates the risk of phishing attacks, which can be costly to an organisation and its bottom line.
• Enforces sender policies: DMARC allows organisations to enforce policies via its DNS record, defining specific practices for email authentication and providing instructions for receiving mail servers about how to enforce them.
• Protects brand reputation: DMARC helps protect an organisation’s brand reputation by preventing cybercriminals from impersonating their domain and deceiving customers and clients into releasing sensitive information.
• Provides thorough authentication reporting: DMARC checks can help support an organisation’s email system by offering comprehensive authentication reporting.
• Functions at scale: DMARC is intended to perform with internet scalability, making it an effective tool for large-scale organisations, institutions, and corporate entities.

While many of these benefits overlap, the underlying function of DMARC is to better protect email through effective authentication and threat mitigation.

Due to the volume of DMARC reports that an email sender can receive and the lack of clarity provided within DMARC reports, fully implementing DMARC authentication can be difficult. These tools and best practices can help ensure your organisation optimises DMARC.

• Publish policies to your DNS record that clearly define your organisation’s practices for email authentication and document instructions for receiving mail servers about how to enforce those policies.
• DMARC parsing tools can help organisations understand the information in DMARC reports.
• Additional data and insights beyond what’s included within DMARC reports help organisations identify email senders faster and more accurately. This helps speed up the implementation of DMARC authentication and reduces the risk of blocking legitimate email.
• Professional service consultants with DMARC expertise can help organisations with DMARC implementation. Consultants help identify all legitimate senders, fix authentication issues, and even work with email service providers to ensure they authenticate properly.
• Organisations can create a DMARC record in minutes and start gaining visibility through DMARC reports by enforcing a DMARC policy of “none”.
• By properly identifying all legitimate email senders—including third-party email service providers—and fixing any authentication issues, organisations should reach a high confidence level before enforcing a DMARC policy of “reject”.

DMARC implementation can be complicated, but it’s a critical protocol in securing your organisation’s email channels and mitigating fraudulent activity.

Implementing DMARC is a powerful solution to protect your email against impostors and fraudulent activity. Creating a DMARC record is the first step to protecting your organisation, customers, and brand reputation from email fraud. You can use Proofpoint’s DMARC Creation Wizard to create a record for your organisation or follow the steps below to get started.

1. DMARC records are hosted on your DNS servers as TXT entries. Every host provider grants DNS access to customers, so you can add this TXT entry from the registrar where the domain was registered or in a dashboard provided by the website host. The steps to create a DMARC record differ based on the registrar or host, but creating the record is the same for every domain. After you authenticate into your host or registrar, create a DNS entry using the following steps:
2. Create a TXT record. After you start the creation process, you must enter a name and value for the record.
3. Name your record “DMARC”. In some host configurations, the domain name is automatically appended to the name. If it is not added automatically, name the record _dmarc.yourdomain.com.
4. Enter the value for your record. The following is an example value for DMARC:
   v=DMARC1; p=none; rua=mailto:youraddress@yourdomain.com.

The three values in the entry are critical for direction when users send emails to your domain. The first “v” value is necessary and defines the version. This value will be the same for all records. The second “p” value determines what happens when the email passes or fails. In this example, the value is set to “none”, indicating nothing will happen. This value is recommended initially to ensure that DMARC works correctly before quarantining messages.

After you verify that DMARC works correctly, the “p” value can be changed to “quarantine” or “reject”. It’s recommended to quarantine messages so that you can catch false positives. The message will be set aside until you review it. The “reject” option will outright drop records that don’t pass DMARC rules. Only use the “reject” option when you are positive that no important messages will be dropped by your DMARC settings.

DMARC and DKIM (or DomainKeys Identified Mail) are email authentication protocols that help organisations fight email compromise and impersonation attacks. However, DMARC is more robust in implementing policies and utilising reporting mechanisms. While both protocols use public key cryptography, DMARC and DKIM each use different methods to validate email flow. DKIM is solely an authentication method, while DMARC generates aggregate reports to help optimise an organisation’s email strategy.

DMARC aligns both SPF and DKIM mechanisms to provide reporting across activities performed under those two policies. This enables domain owners to publish policies in their DNS records specifying how to check the “from:” field presented to end-users and how the receiver should deal with failures.

Simply put, DKIM’s purpose is to verify whether an email is legitimate, while DMARC goes one step further to suggest what to do with email that isn’t legitimate.

DMARC also provides a way for domain owners to specify their own authentication practices and determine the actions taken when an email fails to meet authentication criteria. By relying on DMARC-compliant email, organisations can secure their domain(s) from unauthorised use by fighting daily email security threats.

Proofpoint emphasises the importance of DMARC in protecting against email-based attacks such as phishing and business email compromise (BEC). By implementing DMARC, organisations can gain visibility into who is sending emails on their behalf and distinguish between legitimate and malicious senders.