TechKnowSurge

VideoSecurityFree

Domain-based Message Authentication Reporting and Conformance (DMARC)

DMARC (Domain-based Message Authentication Reporting and Conformance) is a DNS record that builds on SPF and DKIM to define how mail servers should handle messages that fail authentication checks. It also provides reporting capabilities that help domain owners identify legitimate and malicious sources of email sent in their name.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

DMARC, which stands for Domain-based Message Authentication Reporting and Conformance, is a DNS record that works alongside SPF and DKIM to give domain owners greater control over how their email is handled when authentication fails. While SPF verifies the sending server and DKIM validates message integrity, neither standard alone dictates what a receiving server should actually do when something does not check out. DMARC fills that gap by defining a clear policy that receiving servers can follow. A DMARC record contains several key components. The version field identifies the record as DMARC version 1, and the policy field — set to none, quarantine, or reject — determines the action taken against messages that fail SPF or DKIM validation. A percentage value controls what portion of non-compliant mail the policy applies to, which allows domain owners to phase in stricter enforcement gradually rather than risk blocking legitimate mail from systems that have not yet been fully accounted for. Reporting fields can be included as well, directing receiving servers to send aggregate reports back to specified addresses. Those aggregate reports are particularly valuable for visibility and ongoing management. They surface information about all sources sending mail under a domain name, whether authorized systems, third-party services, or actors attempting to spoof the domain. This feedback loop allows administrators to track down unknown sending sources, adjust their SPF and DKIM configurations accordingly, and incrementally tighten their DMARC policy as confidence in their mail environment grows.

What you'll learn

Explain the purpose of DMARC records and how they extend SPF and DKIM to enforce email authentication policies
Identify the key components of a DMARC DNS record, including version, policy options, percentage field, and aggregate reporting

What's covered

DMARC Records

What is DMARC?
- Full Name Defined
- DNS-Based Record
- Extends SPF and DKIM
How DMARC Works
- Server Checks SPF First
- Server Checks DKIM Second
- DMARC Applied on Failure
DMARC Record Fields
- Version Field
- Policy Options
  - None — No Action
  - Quarantine — Flag Suspicious
  - Reject — Block Email
- Percentage Field
  - Controls Policy Application
  - Dial Back for Unknown Sources
- Aggregate Reports
  - Track Mail Sources
  - Identify Spoofing Attempts
Real-World Example
- MX Toolbox Lookup
- Policy Set to None
- Aggregate Report Emails Listed

Key terms

Domain-based Message Authentication, Reporting, and Conformance: Domain-based Message Authentication, Reporting, and Conformance is an email authentication protocol that builds on SPF and DKIM to enable domain owners to specify how unauthenticated emails should be handled and to receive reports on message authentication activity.
Sender Policy Framework: Sender Policy Framework is an email authentication protocol that allows domain owners to specify which mail servers are authorized to send email on their behalf, helping receiving servers identify and reject spoofed messages.
DomainKeys Identified Mail: DomainKeys Identified Mail is an email authentication mechanism that uses asymmetric cryptography to sign outgoing messages, allowing receivers to verify that the email was not altered in transit and originated from an authorized sender.
Domain Name System: A hierarchical naming system that translates human-readable domain names into IP addresses.
Spoofing: An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Authentication: The process of verifying the identity of a user, device, or system.

Topics

Dmarc Email Authentication Spf Dkim Dns Records Email Security Cybersecurity

Transcript

Something related closely to SPF and DKIM records is the DMARC record — Domain-based Message Authentication, Reporting and Conformance.

The way that email works is that we could be receiving messages from any source out there, claiming to be any domain, from any sender. SPF and DKIM allow a certain level of authenticity. When a message gets sent into this domain, it can check who sent this message with the SPF record, and what the message looks like. Does it add up? Is it really coming from the correct domain? And it does both of these using DNS.

But quite honestly, we end up getting a lot of email from a lot of different sources, and it doesn't always come just from the domain. For instance, maybe I sign up for some sort of cloud service, and so it could be sending emails on behalf of me. If this machine gets those emails, what is it to do with them? SPF and DKIM allow it to do some level of verification, but maybe that doesn't give it the full spectrum, the full information.

What DMARC adds

DMARC is a way to add certain features, certain capabilities, to both SPF and DKIM. DMARC is also a record that sits on DNS. What will happen is mail will be sent, and this checking server will then check, number one, SPF, and see if SPF checks out, and number two, the DKIM, and see if DKIM checks out. If something's wrong with those, it can then also check DMARC. Essentially DMARC says what you're going to do with that message if the SPF or DKIM fails.

What's in the record

There are more fields than just these, but we're going to cover a few of the basics.

One of them is the version. We call out that this is DMARC version 1.

Then also the policy. The P stands for policy. What is it going to do? There are three options here: none, quarantine, or reject. Reject just means reject the email. Quarantine means that we're going to treat it as being suspicious and flag it that it could be spam, or whatever the case may be. And none means no special treatment involved with this. So this is if it fails SPF or if it fails the DKIM, then it will follow through with one of these options.

Then the percent is the percentage that it treats as being under this policy. So right now we say reject. Well, what are we rejecting? 100%. If it fails, we're recommending that you get rid of 100% of them. But the problem with that is there could be email coming from sources we're not quite aware of yet, and what we need to do is track those down. So maybe we dial this back to 80%, because 80% is going to come from the systems that we know are sending out email on behalf of us. Then we can start tracking down what that last 20% is, so that we can move that over.

The other thing is maybe we want some feedback: when something gets denied, we want to hear about it so we can track those down and figure out where it's coming from. So we could ask for an aggregated report — and there are other types of reports we could ask for as well — and we can specify how we're going to receive those aggregated reports, so we can really understand where our mail is coming from, who's trying to spoof us, and who are other systems that we have hanging out there that are sending mail on behalf of us.

An example lookup

Just to see what an example of this might look like, I'm at the MX Toolbox website and I'm looking at thef.org for DMARC. I did a lookup on it, and what we can see is that it's using version DMARC 1, the policy is none, and it's requesting an aggregate report being sent to these emails.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →