Introduction

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol that enhances the security of email communication. 

It allows domain owners to control who is authorized to send emails on behalf of their domain, helping prevent phishing, spoofing, and unauthorized use.

A DMARC record, published in your DNS, helps email receivers verify whether a message was legitimately sent from your domain. 

By authenticating your emails with a DMARC record, you reduce the chances of emails landing in the spam folder and strengthen protection for your customers, employees, and brand.

DMARC works in combination with two underlying authentication protocols — SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail). Together, they allow you to set policies that instruct receiving servers to accept, quarantine, or reject emails that fail authentication checks.

 Sample DMARC Record

A DMARC record is included within an organization or domain owner’s DNS database and is a specific version of DNS text records (TXT records). The full DMARC record looks similar to this:

v=DMARC1; p=none; pct=100; rua=mailto:[email protected]; sp=none; aspf=r;

Here’s what each tag means:

• v=DMARC1: Specifies the DMARC version being used.
• p=none: Defines the DMARC policy; in this case, no enforcement is applied, and emails are only monitored.
• pct=100: Indicates that the policy applies to 100% of email messages.
• rua=mailto:[email protected]: Specifies the email address where aggregate DMARC reports will be sent.

Benefits 

The following are the benefits of implementing a DMARC policy:

• Prevents email spoofing by ensuring only authorized senders can use your domain.
• Reduces phishing attacks by blocking fraudulent or impersonated messages.
• Improves email deliverability by helping legitimate emails reach inboxes instead of spam folders.
• Provides visibility and control by providing detailed reports on who is sending emails from your domain.
• Enhances overall email security by building a stronger, more trusted communication channel for your brand.

In this article, you will learn about:

• DMARC Record
• DMARC Policies
• DMARC Authentication

DMARC Policies

DMARC Standards provide three different sets of policies for a domain. This helps you to specify how emails that fail DMARC validation should be handled.

The following are the three policies of DMARC:

• None: No DMARC validation.
• Quarantine: The mail is accepted and placed in the inbox if the validation is successful; otherwise, it is sent to the spam folder.
• Reject: The mail is rejected immediately.

Note: The domain owner can only request the enforcement of its DMARC record. It is up to the inbound mail server to decide whether or not to honor the requested policy.

DMARC Authentication

Google and Yahoo have made it mandatory to add a DMARC policy for your domain. To ensure email delivery, you must authenticate the domain associated with the FROM address. You can configure the DMARC record (policy) for your domain from the DMARC security authentication block on the Email Settings page.

DMARC Record Verification in the CRM

If your domain does not have a DMARC record configured in the DNS Records, the CRM will display a warning message when you add an email address in the Compose Email window.

• You must then navigate to the User Menu > Settings > Email Settings page. Under Sender Authentication Domains, select the domain for which you want to view DMARC records.
• The DMARC Records block in the Email Settings page displays the status of your DMARC record (policy) for the domains you send emails from.
• If you have added a DMARC policy, the Status field displays that a policy exists. 
• If you haven’t configured a DMARC record for your domain yet, you should add a basic policy recommended by Google and Yahoo. The system will display the DMARC record, including the host and TXT values, to ensure proper email delivery.

Verifying DMARC Configuration for Your Domain

Follow these steps to verify if DMARC is configured in your domain:

1. Go to the Mxtoolbox website. (https://mxtoolbox.com/dmarc.aspx)
2. Enter your domain name (for example, example.com) in the search field and click DMARC Lookup.
3. If a DMARC record exists, the tool will display the configured policy.
4. If no DMARC record is found, you will need to create one. You can start by adding a recommended basic policy (e.g., p=none) as outlined above.

To learn more about DMARC, click here.

Reference

• Email Sending Guidelines for Google, Yahoo, Microsoft, and Apple
• Improving Email Deliverability
• Creating a CNAME Record
• Authenticate Emails with SPF, DKIM, and SenderID
• Avoid your emails from landing in Spam