Email security · 4 min read ·
What is DMARC and why does it matter?
Without DMARC, anyone can send email in your company's name. Here is how DMARC, SPF and DKIM work together, and how to check your situation for free.
Imagine that your customer receives an email that seems to come from your company's address. The message says that your bank account has changed and the next invoice must be paid to the new account. The sender's address is exactly right, but the message was sent by a scammer.
This is possible because email was originally designed without proper sender authentication. DMARC is a way to fix this gap for your own domain.
SPF, DKIM and DMARC in brief
Email protection is based on three records stored in your domain's DNS settings:
- SPF lists the servers that may send email in your domain's name.
- DKIM adds a digital signature to messages, which lets the receiver confirm that the message really came from you and was not changed on the way.
- DMARC ties these together. It tells the receiving server what to do with a message that fails the checks, and asks for reports on who is sending email in your domain's name.
SPF and DKIM alone are not enough, because they do not check the sender address that the recipient sees. Only DMARC makes sure that the visible sender and the technical check match.
Three policy levels
The DMARC record defines a policy that tells what is done with messages that fail:
- p=none: messages are delivered normally, but you get reports. A good start, but it doesn't protect anything yet.
- p=quarantine: suspicious messages are sent to spam.
- p=reject: forged messages are rejected completely. This is the target level.
Many companies have introduced DMARC at the none level and stopped there. Then the record exists, but a scammer still gets through.
What do DMARC reports tell you?
Receiving servers regularly send you aggregate reports: from which servers email has been sent in your domain's name, how much, and whether the messages passed the checks. The reports show whether one of your own services has been left unconfigured, and whether someone is already trying to forge your messages. The reports are machine-readable, so it is worth using a tool or a partner to read them.
Why does it matter?
Invoice fraud and scams. Forged messages sent in a company's name are one of the most common ways to trick customers and partners out of money. DMARC makes direct forgery much harder.
Deliverability. Large email services such as Gmail, Yahoo and Outlook.com now require SPF, DKIM and DMARC from bulk senders. Messages from a poorly protected domain end up in spam more easily, including invoices and quotes.
Trust and requirements. Customers' security questionnaires and insurers' forms ask more and more often about email protection. A DMARC record in good order is an easy way to show that the basics are taken care of.
How to introduce DMARC
- Check your current situation. Foregon's free email security check shows in a moment whether SPF and DMARC are in order.
- Find all the services that send email in your name: your email service, newsletter tool, invoicing, online shop and CRM.
- Set up SPF and DKIM for each of these.
- Publish DMARC at the none level and follow the reports for a few weeks.
- When all legitimate senders pass the checks, tighten the policy to quarantine and finally reject.
The most common pitfalls are a forgotten sending service, more than one SPF record and an SPF made up of so many services that it exceeds the allowed number of lookups. It is worth checking the settings whenever you start using a new service that sends email, because that is exactly when legitimate messages easily start getting caught in the checks.
DMARC does not stop a scammer from registering a look-alike domain, so staff security awareness is still important. For continuous monitoring there is Security Meter, which alerts you if your domain's protection weakens.