What is DMARC?

DMARC (Domain-based Message Authentication Reporting and Conformance) is an email validation system that companies use to protect their company’s email domain from being used for phishing scams and other cybercrimes. DMARC leverages the existing email authentication techniques SPF (Sender Policy Framework) and DKIM (Domain Keys Identified Mail). When a domain owner publishes a DMARC record into their DNS, they’ll gain insight in who’s sending email on behalf of their domain. DMARC is an email validation system designed to protect your company’s email domain from being used for email spoofing, phishing scams and other cybercrimes.

Using a combination of the existing SPF and DKIM email protocols, DMARC adds a third layer of security by letting you know when an email coming from your domain was not actually sent by you. This information can be used to get detailed information about the email channel. With this information a domain owner can get control over the email sent on his behalf. You can use DMARC to protect your domains against abuse in phishing or spoofing attacks. Securing your email with DMARC gives email receivers certainty whether an email is legit and has originated from you. This results in a positive impact on email delivery and also prevents others from sending email using your domain.

This page covers everything you need to know about DMARC:

· What is DMARC?

· History of DMARC

· Why DMARC?

· Where does DMARC help?

· DMARC in practice

· Mitigate the impact of spoofing with DMARC

· Misunderstandings about DMARC

· User-friendly DMARC analyzing software

History of DMARC

The DMARC standard was first published in 2012 to prevent email abuse. Several industry leaders have worked together to create the DMARC specification, DMARC was created by PayPal together with Google, Microsoft and Yahoo! These industry leaders came together to develop an operational specification, with the desire that it would be able to achieve formal standards status. They created the DMARC standard based on the existing email authentication techniques SPF (Sender Policy Framework) and DKIM (Domain Keys Identified Mail). DMARC was developed by PayPal with Google, Microsoft and Yahoo! to improve protection of email domains.

The idea behind DMARC was to provide a common framework for email senders and receivers to use when evaluating the authenticity of an email, enabling domain owners to publish their email authentication practices in a machine readable format. This allows domain owners additional visibility into how their messages are being handled as well as protection from email abuse. DMARC originally started as an email security protocol.

At first the protocol was mostly adopted by security experts in the financial industry. Over the course of time DMARC has become more and more recognized by email marketeers for its role in improved deliverability and overall security. More and more companies are implementing DMARC policies in their setup to get rid of phishing attacks effectively.

Why DMARC?

The email channel is often used to send emails that seem to come from your company name. The goal of these messages is to get recipients to respond or take a certain action by clicking on a link, opening an attachment, or transferring money. This can result in serious damage to your reputation and financial loss. With our DMARC solution, you can totally secure your organization against cybercrime. The email channel is one of the most important channels for many companies. Think of customer service, sales and invoicing, but also for attackers. It is a weak point where data theft occurs. The best way to prevent this is by implementing DMARC.

DMARC does not only provides full insight in email channels, it also makes phishing attacks visible. DMARC is more powerful: DMARC is capable of mitigating the impact of phishing and malware attacks, preventing spoofing, protect against brand abuse, scams and avoid business email compromise. DMARC Analyzer shows you hidden or unknown email senders and gives real-time results with our DMARC Lookup tool that allows everyone interested to see the DMARC record of any email sender. By deploying a DMARC record, you will get reports that consist of details on each sent email. Thus, organizations can easily detect spoofing attempts and monitor business email compromise (BEC).

Where does DMARC help?

DMARC helps organizations and their clients by giving them the ability to block phishing attacks. It also provides insight into their email channel. This insight enables an organization to protect its employees, partners, and clients from malicious emails being sent on their behalf. With DMARC an organization can ensure that it only sends authentic emails to its clients. Your organization and its clients are being harmed by malicious emails that appear to originate from your domains.

DMARC helps you block these attacks, and helps you gain valuable insight into your email channel, which you can use to work towards deploying an enforcing a DMARC policy. As an organization you have an email channel that can be used for legitimate purposes, and for malicious uses (phishing attacks). DMARC helps to secure your email channel and gives you insight into who is sending emails on behalf of your domain.

When the DMARC policy is enforced to p=reject, organizations are protected against:

· Phishing on customers of the organisation

· Brand abuse & scams

· Malware and Ransomware attacks

· Employees from spear phishing and CEO fraud to happen

DMARC Analyzer is the only DMARC solution that can provide you full insight into your email channel. Our analytics dashboard also allows you to gain knowledge from the DMARC email authentication reports we receive and process for you. With our dashboard, you will be able to see what emails are sent and received.

DMARC in practice

DMARC helps organizations to protect their legitimate domains in phishing attacks and prevents that malicious individuals can spoof the domain of your organization. It will also show when someone is using one of your subdomains to send email on your behalf. DMARC stops spoofing by checking whether a message is really sent from the domain of the sender, and this happens before the email reaches your inbox. By implementing DMARC, you will not only stop fraudulent activities but you will also keep a good reputation of your domain. DMARC, or Domain-based Message Authentication, Reporting & Conformance, is an email authentication protocol built on the existing standards SPF and DKIM. It protects your business from malicious spoofing attacks, by blocking fraudulent emails before they reach the inbox.

DMARC breaks down barriers between the receiver and sender as it allows both parties to collaborate in order to scale their email security. By implementing DMARC into your DNS record you gain extensive insight in your email channel, including what happens with all incoming messages. ISPs will provide Aggregate (RUA) and Forensic (RUF) DMARC reports on a daily basis at the address specified for each domain that publishes a DMARC record.

The DMARC reports enable you to take timely actions and get a better overview of your email channel and prevent hackers from abusing your domain. These reports help to track the effectiveness of your email security, detect possible issues and improve the safety around your business emails.

Aggregate DMARC reports (RUA)

· Sent on a daily basis

· Provides an overview of email traffic

· Includes all IP addresses that have attempted to transmit email to a receiver using your domain name

Please refer to our article about aggregate DMARC reports for more in-depth information about aggregate DMARC reports.

Forensic DMARC reports (RUF)

· Real time

· Only sent for failures

· Includes original message headers

· May include original message

Please refer to our article about forensic DMARC reports for more in-depth information about forensic DMARC reports. DMARC Analyzer is a complete solution to prevent your domain from phishing and email fraud. DMARC analyzer will give you a complete overview of all your email properties, with that you are able to detect weak points in your email channel and fix them.

The ‘none’ policy will collect feedback reports, that are used for an accurate analysis of your email channel status. When your email channel is secure enough for production, you have the possibility to set up a ‘quarantine’ or ‘reject’ policy. DMARC is becoming an important standard for the internet. The premise of this standard is to bring email authentication to an unprecedented level, stopping or even preventing phishing and malware attacks.

DMARC makes it possible to secure your domains and let you decide what must happen when servers from an ISP receive malicious email. DMARC Analyzer will help you to setup DMARC in the 5 steps that are needed to secure your email domain.

What Is a DMARC Record?

A DMARC record defines the DMARC record rule sets and serves as the foundation of a DMARC implementation. If a domain is set for DMARC, DMARC records alert email recipients. It contains the domain owner’s policy. A DMARC entry also includes a DNS (Domain Name Service) entry. To utilize DMARC, you must first set up a DMARC DNS record. This DMARC record will be utilized by email recipients who have DMARC enabled in their emailing system.