DMARC: telling the world what to do with fakes

Definition

DMARC is defined in RFC 7489. A message passes DMARC if either SPF or DKIM passes and the domain that passed matches the domain in the visible From header. The record's p= tag sets the policy (none, quarantine, reject), rua= names where aggregate XML reports are sent, and optional tags cover subdomains (sp=), the percentage of mail the policy applies to (pct=) and alignment strictness (adkim, aspf).

Why it matters

SPF and DKIM each validate a domain, but not necessarily the one the recipient sees. A phishing message can pass SPF for the attacker's own domain while displaying yours in the From line. DMARC closes that gap by requiring alignment, and it is the only one of the three that lets you tell the rest of the internet to drop forgeries. It also gives you visibility: the reports show every source sending as your domain, legitimate or not.

How it works

1. A receiver evaluates SPF and DKIM on an incoming message.
2. It extracts the domain from the From header and looks up _dmarc.thatdomain.
3. It checks whether a passing SPF or DKIM result is aligned with the From domain.
4. If aligned, the message passes. If not, the receiver applies the published policy and, once a day, sends an aggregate report to the rua address.

Example

_dmarc.yourdomain.co.zm.   IN   TXT   "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.co.zm; pct=100; adkim=r; aspf=r"

Read as: quarantine unaligned mail, apply to all of it, use relaxed alignment (subdomains count), and send reports to dmarc@yourdomain.co.zm.

Rolling it out safely

1. Publish p=none with a rua address. Nothing changes for delivery; reports start arriving.
2. Read the reports for two to four weeks. Identify every legitimate source: your mail host, CRM, invoicing tool, newsletter service.
3. Make each source align: add it to SPF or, better, have it sign DKIM with your domain.
4. Move to p=quarantine, optionally with pct=25 and increase.
5. Move to p=reject. This is the goal; anything less still lets forgeries reach inboxes.

Common problems

• Jumping straight to reject. Legitimate systems that were never aligned stop delivering. Start at none.
• No rua address. You get no reports and cannot see what is failing.
• Reports are XML. They are meant for tools; a report-processing service or script makes them readable.
• Third-party senders signing with their own domain. Passes DKIM, fails alignment. Ask them for a custom DKIM domain.
• Forwarding. SPF breaks on forwarding; DKIM should carry the pass. If a list modifies the body, DKIM breaks too, and the mail is judged by your policy.

How ontechmail handles it

The dashboard provides a starting DMARC record for every domain and seeds it on ontechmail-hosted DNS. Because every message sent through the platform is DKIM-signed with your own domain's key, mail from webmail, the OMail app, SMTP submission and the API aligns by default, which makes the path to p=reject short for most customers. DMARC is recommended rather than required; ontechmail will deliver your mail without it, but recipients' providers increasingly will not. For inbound mail, the platform's spam scoring uses DKIM verification results as one of its signals. The email security page shows where DMARC sits among the other controls.

Frequently asked questions