Domain-based Message Authentication, Reporting and Conformance (DMARC) is an email-validation system designed to detect and prevent email spoofing. It provides a mechanism which allows a receiving organization to check that incoming mail from a domain is authorized by that domain's administrators and that the email (including attachments) has not been modified during transport. It is thus intended to combat certain techniques often used in phishing and email spam, such as emails with forged sender addresses that appear to originate from legitimate organizations. DMARC is specified in RFC 7489.
DMARC is built on top of two existing mechanisms, Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM). It allows the administrative owner of a domain to publish a policy on which mechanism (DKIM, SPF or both) is employed when sending email from that domain and how the receiver should deal with failures. Additionally, it provides a reporting mechanism of actions performed under those policies. It thus coordinates the results of DKIM and SPF and specifies under which circumstances the
From: header field, which is often visible to end users, should be considered legitimate.
DMARC's validation of the From field has similarities to Author Domain Signing Practices (ADSP, originally called DKIM Sender Signing Practices, DKIM-SSP). The reporting aspect builds on Abuse Reporting Format (ARF).[note 1]
A group of leading organizations came together in the spring of 2011 to collaborate on a method for combating fraudulent email at Internet-scale, based on practical experience with DKIM and SPF. They aimed to enable senders to publish easily discoverable policies on unauthenticated email - and to enable receivers to provide authentication reporting to senders to improve and monitor their authentication infrastructures.
The resulting DMARC specification was published on January 30, 2012, and within one year DMARC was estimated to protect 60% of the world's mailboxes.
A DMARC policy allows a sender's domain to indicate that their emails are protected by SPF and/or DKIM, and tells a receiver what to do if neither of those authentication methods passes - such as junk or reject the message. DMARC removes guesswork from the receiver's handling of these failed messages, limiting or eliminating the user's exposure to potentially fraudulent & harmful messages. DMARC also provides a way for the email receiver to report back to the sender's domain about messages that pass and/or fail DMARC evaluation.
DMARC is designed to fit into an organization's existing inbound email authentication process. The way it works is to help email receivers determine if the purported message aligns with what the receiver knows about the sender. If not, DMARC includes guidance on how to handle the "non-aligned" messages. DMARC doesn't directly address whether or not an email is spam or otherwise fraudulent. Instead, DMARC requires that a message not only pass DKIM or SPF validation, but that it also pass alignment. For SPF, the message must PASS the SPF check, and the domain in the From: header must match the domain used to validate SPF (must exactly match for strict alignment, or must be a sub-domain for relaxed alignment). For DKIM, the message must be validly signed and the d= domain of the valid signature must align with the domain in the From: header (must exactly match for strict alignment, or must be a sub-domain for relaxed alignment). Under DMARC a message can fail even if it passes SPF or DKIM, but fails alignment.
To ensure the sender trusts this process and knows the impact of publishing a policy different than
p=none (monitor mode), the receiver sends daily aggregate reports indicating to the sender how many emails have been received and if these emails passed SPF and/or DKIM and were aligned.
DMARC operates by checking that the domain in the message's
From: field (also called "5322.From") is "aligned" with other authenticated domain names. If either SPF or DKIM alignment checks pass, then the DMARC alignment test passes.
Alignment may be specified as strict or relaxed. For strict alignment, the domain names must be identical. For relaxed alignment, the top-level "Organizational Domain" must match. The Organizational Domain is found by checking a list of public DNS suffixes, and adding the next DNS label. So, for example, "a.b.c.d.example.com.au" and "example.com.au" have the same Organizational Domain, because there is a registrar that offers names in ".com.au" to customers.
Like SPF and DKIM, DMARC uses the concept of a domain owner, the entity or entities that are authorized to make changes to a given DNS domain.
SPF checks that the IP address of the sending server is authorized by the owner of the domain that appears in the SMTP
MAIL FROM command. (The email address in MAIL FROM is also called envelope-from or 5321.MailFrom.) In addition to requiring that the SPF check passes, DMARC additionally checks that 5321.MailFrom aligns with 5322.From.
DKIM allows parts of an email message to be cryptographically signed, and the signature must cover the From field. Within the DKIM-Signature mail header, the
d= (domain) and
s= (selector) tags specify where in DNS to retrieve the public key for the signature. A valid signature proves that the signer is a domain owner, and that the From field hasn't been modified since the signature was applied. There may be several DKIM signatures on an email message, DMARC requires one valid signature where the domain in the
d= tag aligns with the sender's domain stated in the
From: header field.
DMARC records are published in DNS with a subdomain label
_dmarc, for example
_dmarc.example.com. Compare this to SPF at
example.com, and DKIM at
The content of the TXT resource record consists of
name=value tags, separated by semicolons, similar to SPF and DKIM. For example:
v is the version,
p is the policy,
sp the subdomain policy,
pct is the percent of emails to check, and
rua is the URI to send aggregate reports to. In this example, the entity controlling the example.com DNS domain intends to monitor SPF and/or DKIM failure rates, and doesn't expect emails to be sent from subdomains of example.com.
DMARC is capable of producing two separate types of reports. Aggregate reports, are sent to the address specified under the
rua and Forensic reports are emailed to the address following the
ruf tag. These mail addresses must be specified in URI mailto format (e.g. mailto:email@example.com ).
Aggregate Reports are sent in in the form of .ZIP compressed XML files  typically once per day with the filename format filename = receiver "!" policy-domain "!" begin-timestamp "!" end-timestamp "." extension (e.g.
acme.org!example.com!1335571200!1335657599.zip) . Currently, the SPF and DKIM results in the auth_results are raw results, regardless of Identifier Alignment. The results of the DMARC evaluation with Identifier Alignment are in the policy_evaluated section. 
An example sample report with only one record, showing the results for 2 pieces of mail
<?xml version="1.0" encoding="UTF-8" ?> <feedback> <report_metadata> <org_name>acme.com</org_name> <email>firstname.lastname@example.org</email> <extra_contact_info>http://acme.com/dmarc/support</extra_contact_info> <report_id>9391651994964116463</report_id> <date_range> <begin>1335571200</begin> <end>1335657599</end> </date_range> </report_metadata> <policy_published> <domain>example.com</domain> <adkim>r</adkim> <aspf>r</aspf> <p>none</p> <sp>none</sp> <pct>100</pct> </policy_published> <record> <row> <source_ip>220.127.116.11</source_ip> <count>2</count> <policy_evaluated> <disposition>none</disposition> <dkim>fail</dkim> <spf>pass</spf> </policy_evaluated> </row> <identifiers> <header_from>example.com</header_from> </identifiers> <auth_results> <dkim> <domain>example.com</domain> <result>fail</result> <human_result></human_result> </dkim> <spf> <domain>example.com</domain> <result>pass</result> </spf> </auth_results> </record> </feedback> Sender Questions
Forensic Reports are generated in real time and consist of redacted copies of individual emails that failed SPF, DKIM or both based upon what value is specified in the
DMARC policies are published by domain owners and applied by mail receivers to the messages that don't pass the alignment test. The domain being queried is the author domain, that is the domain to the right of
@ in the
From: header field. The policy can be one of
none the so-called monitor mode,
quarantine to treat the message with suspicion according to the receiver capabilities, or
reject to reject the message outright. Reject policy is fine for domains that don't have individual human users, or for companies with firm staff policies that all mail goes through the company mail server, and employees don't join mailing lists and the like using company addresses, or the company provides a separate less strictly managed domain for its staff mail. Strict policies will never be appropriate for public webmail systems where the users will use their mail addresses any way one can use a mail address.
In fact, human use of a mail address may involve email forwarding from a dismissed address, and mailing lists, which are frequent causes of legitimate breakage of the original author's domain DKIM signature and therefore DMARC alignment. Various workarounds have been proposed to cope with domains that publish strict policies unwittingly. For example, a mailing list manager should reject posts from authors who use problematic email domains. The latter behavior is the most respectful of the communication protocols as well as the domain owner's will. However, it might cause inconveniences in the face of sudden policy changes. According to John Levine, a well known mail expert, the least intrusive way to temporarily mitigate the damage would be to rewrite the
From: address in a predictable, comprehensible manner, such as the following:
change From: John Doe <email@example.com> to From: John Doe <firstname.lastname@example.org.INVALID>
.INVALID top level domain is reserved by RFC 2606 for such kind of usage. In order to apply that change, before re-mailing a message, a mail agent must look up the TXT RR at
_dmarc.example.com, if any, and check if it specifies a strict policy. If the change is applied, any recipient who wishes to reply to the author can easily find out how to correct the address; in the same way, search engines that crawl mail archives can learn to discard the invalidating suffix. However, mail receiving systems may adversely treat an email containing an invalid domain in its key header fields.
For a more intrusive workaround, for forwarders that make changes to either the body or subject of the message, therefore invalidating the DKIM signature of the original author's domain, the
From: field can be rewritten, thereby taking ownership of the message. The original author's address can then be added to the
A number of mailing lists have adopted variations of rewriting the
From: header. One approach is to show both the original sender and list (or list operator) in the display name:
From: John Doe via MailingList <email@example.com>
For reply-to-author rather than reply-to-list, a Reply-To header can be added with only the original author's, but not the list's address:
Reply-To: John Doe <firstname.lastname@example.org>
Another approach is to assign a user ID and forward replies through the list;[note 2] where an opaque ID is used, this keeps the user's "real" email address private from the list:
From: John Doe <email@example.com>
Several mailing lists software now propose various options to deal with members posting from a domain with
p=reject. For instance Mailman 2.1.16 (16 October 2013) and onward have such options.
Making changes to the
From: header field to pass DKIM alignment may bring the message out of compliance with RFC 5322 section 3.6.2: "The 'From:' field specifies the author(s) of the message, that is, the mailbox(es) of the person(s) or system(s) responsible for the writing of the message." Mailbox refers to the author's email address. The
Sender: header is available to indicate that an email was sent on behalf of another party, but DMARC only checks policy for the From domain and ignores the Sender domain.[note 3]
Both ADSP and DMARC reject using the Sender field on the basis that many user agents don't display this to the recipient.
Setting up DMARC on a domain requires creation of sub-domains starting with an underscore. Some DNS providers, however, such as 1&1, do not allow the creation of sub-domains starting with an underscore. Additionally, some providers, such as Network Solutions, do not support underscores in cname records, which interferes with the consolidation of multiple records by CNAME redirection.
- Receivers: AOL, Comcast, Google (Gmail), Netease (163.com, 126.com, 188.com, yeah.net), Microsoft (Outlook.com, Hotmail), Yahoo, Mail.Ru, XS4ALL, Yandex
- Senders: American Greetings, Bank of America, Facebook, Fidelity Investments, LinkedIn, PayPal, JPMorganChase, Twitter
- Intermediaries and vendors: Agari, Cloudmark, Netcraft, ReturnPath, Trusted Domain Project, Symantec
- Author Domain Signing Practices
- Demarcation point
- E-mail authentication
- Certified email
- Mail servers with DMARC
- The "auth-failure" feedback type was added to ARF in RFC 6591 (2012).
- Eric Thomas described the updated behaviour of Listserv software: "incoming Yahoo and AOL addresses are automatically rewritten to local addresses that can receive private replies and forward them to the original poster"
- Use of the Sender field by remailers is mentioned (in the context of DKIM, not DMARC) in sections B.1.4 and B.2.3 of RFC 4871.
- M. Kucherawy; E. Zwicky (March 2015). Domain-based Message Authentication, Reporting, and Conformance (DMARC). IETF. RFC 7489. https://tools.ietf.org/html/rfc7489.
- "History", dmarc.org
- "In First Year, DMARC Protects 60 Percent of Global Consumer Mailboxes". dmarc.org. 6 February 2013. Retrieved 10 April 2014.
- Mark Sapiro (16 October 2013). "Mailman and DMARC". list.org. Retrieved 13 August 2015.
- Lucian Constantin (8 April 2014). "Yahoo email anti-spoofing policy breaks mailing lists". PC World. Retrieved 15 April 2014.
- Vishwanath Subramanian (22 April 2014). "AOL Mail updates DMARC policy to 'reject'". AOL. Retrieved 13 August 2015.
- "Status of DMARC, dmarc.org
- Kucherawy, Murray. The Current DMARC Internet Draft. IETF.org. Jul 15, 2013
- "Bulk Senders Guidelines - Gmail Help". support.google.com. Retrieved 2015-04-24.
- "DMARC - FAQ".
- "I need to implement aggregate reports, what do they look like?". DMARC.org. Retrieved 26 May 2016.
- "I need to implement aggregate reports, what do they look like?". DMARC.org. Retrieved 26 May 2016.
- John Levine (8 April 2014). "DMARC: perspectives from a listadmin of large open-source lists". IETF Discussion List. IETF. Retrieved 11 April 2014.
- John Levine (31 May 2014). "Mitigating DMARC damage to third party mail". wiki. ASRG. Retrieved 1 June 2014.
- Al Iverson (9 April 2014). "Spam Resource: Run an email discussion list? Here's how to deal with DMARC". spamresource.com. Retrieved 18 April 2014.
- "How Threadable solved the DMARC problem". Threadable Blog. Retrieved 21 May 2016.
- "LISTSERV® Inventor Develops Seamless Solution to DMARC Hassles". L-Soft Press Releases. Retrieved 22 May 2016.
- Kucherawy, M.; Zwicky, E. (July 15, 2013). "Domain-based Message Authentication, Reporting and Conformance (DMARC) [draft 01]". IETF. Appendix A.3, Sender Header Field. Retrieved 24 May 2016.
- DMARC specification Acknowledgements
- DMARC Contributors (PDF)
- Vitaldevara, Krish (10 December 2012). "Outlook.com increases security with support for DMARC and EV certificates". Outlook Blog. Microsoft. Retrieved 12 December 2012.
- Martin, Franck (20 September 2012). "DMARC: a new tool to detect genuine emails". LinkedIn Engineering Blog. Linkedin. Retrieved 17 August 2013.
- Josh Aberant (21 February 2013). "Introducing DMARC for Twitter.com emails". twitter.com. Retrieved 10 April 2014.
- Ian McShane (27 March 2014). "Introducing DMARC Validation in Email Security.cloud". symantec.com. Retrieved 10 April 2014.