A DMARC record is an entry into the DNS record of the organization and is a requirement for using DMARC. It informs all the major ISPs like Gmail and Microsoft that their domain is configured to deploy DMARC.
However, first, let’s get a little insight into what DMARC is and what role DMARC records play.
What does DMARC do?
If you want to protect your organization from becoming a victim of email compromise, phishing scams and other forms of cyber threat, including data breaches, sending of fake invoices etc., DMARC is the way to go. It is an email authentication protocol and can play an integral role in an organizations cyber-defence framework.
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It safeguards an organization’s brand’s domain from hackers and phishing parties who may try to impersonate its brand and send emails through what seems to be the organization’s domain address.
DMARC record
As suggested earlier, a DMARC record is a requirement for applying DMARC on emails. It is an entry in the DNS (Domain Name server) record of the organization.
A DMARC record informs the ISPs of the organization’s domain and email verification policy. This is done after two other email authentication protocols have passed the email, including SPF (Sender Policy Framework) or DKIM (Domain keys Identified Mail) or both.
DMARC record also informs email servers to provide a report to the reporting email address that is added in the DMARC record. The reports help the organization evaluate their emails and help them identify every user using their email domain.
Once DMARC is configured and the DMARC record is entered in the DNS, the DMARC activity is analyzed to check what is sent from the brand’s domain. Following this, the DMARC record checker is used to authenticate DMARC records. With the help of the records, the organizational policy then determines how the email will be treated. Usually, three kinds of approaches are followed.
- None: normal monitoring of the email traffic, and no action may be taken. Sometimes messages are sent as a normal email, but a warning may be included.
- Quarantine: if the email fails the DMARC check, it may be subjected to quarantine and diverted to the spam folder. The end-user can approve it manually later.
- Reject: if the email is unauthorized, it is not allowed to be delivered; this policy is the ultimate goal of applying DMARC.
Thus a DMARC record provides the DMARC policy of the domain. While some emails may be marked as spam even if there is no DMARC record, with a DMARC record in place, the servers have clear instructions on how to treat the email.
