Which DMARC Policy Fits? — TechKnowSurge

About this interactive

SPF and DKIM let a receiver check mail claiming to come from your domain, but they do not say what to do when the check fails. DMARC, Domain-based Message Authentication, Reporting and Conformance, is a DNS record that does. A message passes DMARC when SPF or DKIM passes for the domain in its From address; it fails DMARC only when neither does. (The video says the policy applies if SPF or DKIM fails; it applies when both fail.) The record starts v=DMARC1. The p field is the policy: none asks for no special treatment, quarantine asks receivers to treat failing mail as suspicious, typically flagging it as spam, and reject asks them to refuse it. The pct field applies the policy to a share of the failing mail, so an owner can tighten gradually while tracking down legitimate senders it missed. rua asks receivers to send aggregate reports, which show who is sending as the domain. Owners usually start at none, move to quarantine, and end at reject once every real sender passes. Receivers make the final call; the policy is the owner's request.

What you'll learn

Choose the DMARC policy, p=none, p=quarantine or p=reject, that matches a domain owner's goal for mail that fails DMARC
Explain how DMARC builds on SPF and DKIM, and what the pct field and aggregate reports add

Aligned to

CompTIA Security+

4.5 Given a scenario, modify enterprise capabilities to enhance security.

Key terms

Domain-based Message Authentication, Reporting, and Conformance: Domain-based Message Authentication, Reporting, and Conformance is an email authentication protocol that builds on SPF and DKIM to enable domain owners to specify how unauthenticated emails should be handled and to receive reports on message authentication activity.
Sender Policy Framework: Sender Policy Framework is an email authentication protocol that allows domain owners to specify which mail servers are authorized to send email on their behalf, helping receiving servers identify and reject spoofed messages.
DomainKeys Identified Mail: DomainKeys Identified Mail is an email authentication mechanism that uses asymmetric cryptography to sign outgoing messages, allowing receivers to verify that the email was not altered in transit and originated from an authorized sender.
Spoofing: An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Quarantine: A disposition action taken by a mail gateway that isolates suspicious or high-scoring email messages for review rather than delivering them directly to the recipient or dropping them outright.

Topics

Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →