DMARC

DMARC Policies ?

DMARC policies start with none(p=none), quarantine(p=quarantine) and finally Reject(p=reject).

Before getting started with the policies, let's understand what the DMARC records look like and the meaning of their various tags.

v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1; adkim=r; aspf=r; pct=100; rf=afrf; 

Tag	Value	Explanation
v	DMARC1	The v tag is required and represents the protocol version. An example is v=DMARC1
p	reject	The required p tag demonstrates the policy for domain (or requested handling policy). It directs the receiver to report, quarantine, or reject emails that fail authentication checks. Policy options are: 1) None 2) Quarantine or 3) Reject.
rua	[email protected]	This optional tag is designed for reporting URI(s) for aggregate data. Here is rua example rua=mailto:[email protected]. RUA Report Email Address(s) (rua)
ruf	[email protected]	Like the rua tag, the ruf designation is an optional tag. It directs addresses to which message-specific forensic information is to be reported (i.e., comma-separated plain-text list of URIs).Here is example of ruf=mailto:[email protected]. RUF Report Email Address(s) (ruf)
fo	1	The FO tag pertains to how forensic reports are created and presented to DMARC users. Failure Reporting Options (fo)
adkim	r	Similar to aspf, the optional adkim tag is the alignment mode for the DKIM protocol. A sample tag is adkim=r.
aspf	r	The aspf tag represents alignment mode for SPF. An optional tag, aspf=r is a common example of its configuration.
pct	100	This DMARC tag specifies the percentage of email messages subjected to filtering. For example, pct=25 means a quarter of your company's emails will be filtered by the recipient. Percentage (pct)
rf	afrf	Forensic reporting format(s) is declared by the DMARC rf tag. Report Format (rf)

P=none: Monitoring Mode

By implementing this policy, the sender's domain tells the recipient server not to take action on any emails that fail SPF and DKIM checks. If the sender's domain has included an RUA tag, the recipient server will begin sending DMARC XML reports to the email address specified in the RUA tag.

P=quarantine: Redirects Emails to Spam Folder

When DMARC policy is set to quarantine, any email failing SPF and DKIM checks will end up in the recipient's spam folder. The sender will also get DMARC reports at this stage. However, phishing or spoofed emails may still reach the recipient's server until this DMARC stage.

DMARC Reject: Final Action Stage

To get the most out of DMARC, you need to set your DMARC policy to p=reject. This means that any email that fails SPF and DKIM checks won't be accepted by the recipient server. This is the final policy of DMARC, where emails failing authentication are rejected.

To apply these policies, you need to use the DMARC dashboard to see if any legitimate SMTP sources fail SPF and DKIM authentications. Otherwise, your genuine emails might be rejected or quarantined (depending on the DMARC policy stage). While most major ESPs check for DMARC records, some older servers haven't adopted this, allowing spoofed emails to be delivered even if the DMARC policy is set to quarantine or reject.