Q&A on DMARC policies

We incentivize our customers to stay as protected as possible in the email realm. And DMARC plays a very important role! Here's a summary of the important aspects of DMARC, based on the most common questions our teams get from our customers.

How Does DMARC Enforce Policies Over SPF and DKIM?

SPF and DKIM are vital for email authentication, and DMARC adds an extra layer of security by determining how receiving mail servers should handle emails that fail SPF and DKIM checks. DMARC looks at the "alignment" of the sending domains to enforce specific policies.

Here’s how DMARC works:

1. SPF and DKIM Validation:
   • SPF verifies that the sender’s IP address is authorized to send emails for that domain.
   • DKIM ensures that the email hasn’t been tampered with during transit.
2. DMARC Alignment: DMARC checks whether the domain in the “From” header matches the domains used for SPF or DKIM. Even if either SPF or DKIM passes, the email can fail DMARC if the domain alignment is incorrect.
3. DMARC Policy Actions:
   • None: No action is taken, but reports are generated to help monitor your domain's email activity.
   • Quarantine: Emails failing DMARC are sent to the spam folder.
   • Reject: Emails failing DMARC are blocked entirely.

DMARC not only verifies that emails pass SPF and DKIM checks but also ensures domain owners control how failed emails are treated. This makes it a critical part of maintaining secure email communication.

How does DMARC work with Different Email Addresses and Shared Mailboxes?

DMARC operates on the domain level, checking alignment between SPF/DKIM records and the domain in the “From” header. If, for example, the email comes from someone@acme.com, but the return-path address is someoneelse@acme.com, it could cause issues if the domains don’t align.

For shared mailboxes, DMARC will check the domain’s alignment in both the “From” header and the SPF or DKIM signature. As long as the alignment matches, DMARC will pass.

How does it manage Multiple Email Sources, SPF Limits, and DKIM configurations?

It’s all about the DNS. For organizations with numerous SaaS applications sending emails, maintaining SPF records can become complex so that the DNS lookup limits are kept. And each platform you use for sending emails will require its own DKIM key, that you should add (the Public key) to your DNS records.

What about SPF and DMARC for Group Emails?

Group emails can be an issue, Group email control modifies the “From” address to ensure the email is delivered, even if your domain’s DMARC record calls for stricter actions (such as quarantine and reject)

How to manage Subdomains for Email Authentication?

If you use subdomains for sending emails or for certain email services like Amazon SES, you’ll need to set up SPF and DKIM records for those subdomains. While DMARC policies for the root domain apply to subdomains by default, you can also configure specific DMARC policies for subdomains using the “sp” tag.