Skip to main content

DMARC (Domain based Message Authentication, Reporting and Conformance)

Introduction

Sender Policy FrameworkDMARC (SPF)Domain-based Message Authentication, Reporting and Conformance) is an email authentication methodprotocol. It is designed to detectgive forgingemail senderdomain addresses duringowners the deliveryability to protect their domain from unauthorized use, commonly known as email spoofing. The purpose and primary outcome of theimplementing email. SPF alone, though,DMARC is limited only to detectprotect a forgeddomain senderfrom claimed in the envelope of the email which is used when the mail gets bounced. Only in combination with DMARC can it be used to detect the forging of the visible sender in emails (email spoofing), a technique oftenbeing used in business email compromise attacks, phishing emails, email scams and emailother spam.cyber threat activities. source

Description

SPFThe owner of a domain can, by means of a DNS record, publish a policy that states how to handle e-mail (deliver, quarantine, reject) which is thenot mostproperly basicauthenticated email authentication method. It involves simple DNS records that allow you to specify what servers email can originate from for the domain specified in theusing emailSPF envelope(Sender Policy Framework) and/or DKIM (DomainKeys Identified Mail).

Read More

Example

As an example, swigg.net is setup with twothe SPFfollowing rules.DNS record.

sp=none;
Domain Type Value
@_dmarc TXT v=spf1DMARC1; mxp=quarantine; include:_spf.google.comrua=mailto:dustin@swigg.net; include:me.comruf=mailto:dustin@swigg.net; -all
*TXTv=spf1 mx:swigg.net -allri=86400

TheseThis two entriesrule can be read as follows:telling MTA (Mail Transfer Agents) the following.

  1. Any

    emailendingin@swigg. hasfromoneofthe orfromaGoogle/AppleAnyotherserver sending email on behalf of this domain will be rejected.

  2. Any email ending in @*.swigg.net has to originate from one of the MX records defined for swigg.net. Any other server sending email on behalf of these domains will be rejected.

    3. Component Description
    p=quarantinetreat mail that fails DMARC check as suspicious
    rua=mailto:dustin@swigg.net send aggregated reports to originatedustin@swigg.net
    ruf=mailto:dustin@swigg.net send MXforensic recordsreports definedto dustin@swigg.net
    sp=nonetreat mail that fails DMARC check as suspicious for swigg.netsubdomains
    ri=86400 send serverreports definedevery in24 theirhours SPF(86400 policy.seconds)
Back to top