DMARC
Definition
Domain-based Message Authentication, Reporting and Conformance. A DNS policy that stacks on top of SPF and DKIM, telling receivers what to do (none, quarantine, reject) on failure, and where to send aggregate (rua) and forensic (ruf) reports.
- Full name
- Domain-based Message Authentication, Reporting and Conformance
- Built on
- SPF and DKIM
- Policy actions
- none, quarantine, reject
- Report types
- Aggregate (rua) and forensic (ruf)
Common questions
How does a DMARC policy help an investigator confirm an email was spoofed?+
A domain's published DMARC record shows what the legitimate owner instructed receivers to do on authentication failure, so a spoofed message that failed SPF and DKIM alignment but was still delivered indicates either a lenient policy setting or a receiver that did not enforce it.
What is the difference between DMARC's rua and ruf reports?+
Aggregate (rua) reports summarise authentication results across many messages over a period, useful for trend analysis, while forensic (ruf) reports contain details of individual failing messages, though many receivers no longer send ruf reports due to privacy concerns.
Related terms
- DKIM
- DomainKeys Identified Mail. A cryptographic signature placed in a DKIM-Signature header. The signing key sits on the sending server; the public key...
- MTA
- Mail Transfer Agent. The server that relays mail server-to-server. Postfix, Exim, Sendmail and Microsoft Exchange are the common implementations. Speaks SMTP.
- MUA
- Mail User Agent. The client the user sees. Outlook, Thunderbird, Apple Mail, Gmail web, Spark, mobile apps. Speaks SMTP outbound and IMAP...
- Received Header
- A header line prepended by each mail server that accepts a message in transit, recording the server's own identity, the IP or...
- SPF
- Sender Policy Framework. A DNS TXT record on the sender domain that lists the IP addresses authorised to send mail for that...