DMARC FAQs (Frequently Asked Questions)

DMARC FAQs

What is DMARC?

DMARC, short for Domain-based Message Authentication, Reporting & Conformance, is an email authentication protocol to check if an email message really originates from where it claims to have, based on SPF and DKIM. In addition to email authentication, it also adds reporting capabilities, so that domain owners can examine email authentication statistics on their domains.

Why use DMARC? Does DMARC prevent spoofing?

Yes, it does. When DMARC is implemented in the reject mode, it prevents all spoofing emails from ever reaching the inbox.

Who is using DMARC? Give me some companies using DMARC?

Most (if not all) email service providers support DMARC, which is the de facto email authentication in the industry. Not supporting DMARC would be an anomaly.

Companies that support DMARC include: Google, Microsoft, Amazon, LinkedIn, and many more.

Is DMARC for small and medium-sized businesses (SMB) or large enterprises?

DMARC is necessary for any business who cares about their email deliverability, security and brand reputation, be it big or small.

Is implementing DMARC hard?

Not all all. You can generate a DMARC record using our free online DMARC record generator and publish it in the DNS in 5 minutes, and start seeing aggregate reports dripping in after a day or two. That will give you some insight into the email streams on your domain, then you can move on to implement the quaratine/reject modes of DMARC.

Should I use DMARC?

You should in order to protect your domain from being email-spoofed, your brand reputation from being blemished, and your business from direct financial loss, stolen intellectual property, etc.

How do I fix "no DMARC record"?

Please refer to: How to fix "No DMARC Record Found"

What does "no DMARC record found" mean?

It simply means no DMARC record was found on your domain. Please refer to: How to fix "No DMARC Record Found" to create a DMARC record.

Is a DMARC record necessary?

A DMARC record is necessary for setting up DMARC monitoring. You specify an rua tag in the record and point it to the receiving mailbox to receive DMARC reports.

In addition, if you want to quarantine or reject unauthenticated email messages, you will need to publish a DMARC record with p=quarantine or p=reject on the domain.

What is a DMARC record?

A DMARC record is a TXT record published in the DNS to tell email servers how to handle unauthenticated emails, and where to report email authentication stats to. A DMARC record is published by the domain owner, and enforced by email servers.

What is DMARC policy?

A DMARC policy is the value specified by the p= tag inside a DMARC record. It has 3 modes: none, quarantine, and reject. Email servers rely on it for the disposition of unauthenticated emails.

How do I get/create/build/generate a DMARC DNS record?

You can use DMARCLY's free tool to create a DMARC record. Simply enter the settings, hit the Generate DMARC Record button, and you will have a DMARC record. Access DMARC record generator here.

How do I add a DMARC record in DNS?

Once you have your DMARC record ready, log in to your DNS service provider's dashboard, and create a TXT record on the subject domain. Set the host to _dmarc and the value to the DMARC record.

If you are using a common DNS service provider, check one of the tutorials below:

Who sends DMARC reports?

Nowadays, almost all email service providers support sending DMARC aggregate reports, including: Gmail, Office 365, Yahoo! Mail, and many others. Although a lot fewer ESP's send forensic (failure) reports, due to privacy and volume concerns.

Does DMARC handle inbound email, outbound email, or both?

DMARC only handles outbound email. It doesn't handle inbound email.

I've set up SPF/DKIM for my sender. But DMARCLY shows emails from that senders are still unauthenticated?

There is usually a delay up to 24 hours before the DMARC reports are received, after these emails were sent. And DNS propagation can take a few hours before the SPF/DKIM records become accessible to all across the Internet.

If you set up for that sender (say Mailchimp) just recently, chances are mailbox service providers haven't picked up the changes yet.

Please give it a couple of days and check again. Then you should see the expected results.

How to prevent a sender from sending emails on my behalf with DMARC?

We assume that the sender is an illegitimate one. In this case, simply turn on p=reject in your DMARC record and emails from that particular sender will be rejected.

If you have set up SPF/DKIM for that sender before, make sure to clear the settings too, so that the emails won't pass SPF or DKIM.

Can I buy DMARC for my email?

Sure you can! DMARCLY is a DMARC report analysis service provider which handles all the chores ranging from setting up recipient mailboxes, parsing reports, to rendering reports. This comes in handy as you can save time for more productive tasks.

Article précédent Article suivant

 Protect Business Email & Improve Email Deliverability

Get a 14 day trial. No credit card required.

Create Account