What is DMARC? SPF, DKIM and DMARC explained..
DMARC is the email-authentication standard that helps mail servers decide what to do with messages that claim to be from your domain. It also gives you reports showing which systems are sending email as your domain.
Why email needs this at all
By default, anyone can write your domain in the From line. Email does not verify that the address in the 'From' field is correct. A message can claim to come from accounts@yourhome.com even if it was really sent by threatactor@badhost.com.
SPF, DKIM and DMARC help receiving mail servers check if a message from your domain is actually authorized by you.
SPF: who's allowed to send
SPF stands for 'Sender Policy Framework'. With SPF you publish a DNS record listing the servers and services, that are allowed to send mail on behalf of your domain. When a message arrives, the receiving mail server checks if it came from an accepted source.
SPF is useful, but it also has its limitations. It checks the envelope sender (The original sending server), which is not always the same as the 'From' sender. SPF can also fail if an email is forwarded, because that often changes the sending server to the mail server used by the person/system that forwarded the email.
For that reason, SPF is important, but we can not rely on it alone. We need more verification.
DKIM: a cryptographic signature
DKIM stands for 'DomainKeys Identified Mail'. With DKIM, your sending mail server adds a cryptographic signature to each message. The receiving mail server verifies that signature using a public key published in DNS.
A valid DKIM signature shows that the message was signed by a system with access to your DKIM key, and that important parts of the message were not changed after it was signed
DKIM is especially important because the signature can survive forwarding. That makes DKIM a part of reaching DMARC enforcement without breaking on forwarded emails.
Alignment: the part DMARC depends on
SPF or DKIM passing is not enough by itself. They also need to pass for a domain the matches the visible 'From' address.
This is called Alignment.
This means that a domain can pass SPF or DKIM without being authorized by your domain, but for DMARC to pass, SPF or DKIM must align with the domain in the 'From' address.
DMARC: the policy layer
DMARC stands for 'Domain-based Message Authentication, Reporting & Conformance'.
DMARC builds on SPF and DKIM and adds two important things: Policy and Reporting.
With one DNS record you can tell receiving mail servers:
- SPF or DKIM must pass and align with the 'From' domain.
- Messages that fail should be monitored, quarantined or rejected.
- Aggregate reports should be sent back to you.
The policy can be set to:
p=none- monitor onlyp=quarantine- send failing messages to spam or quarantinep=reject- reject failing messages
Even with p=none, DMARC reports can show which services are sending mail as your domain, which ones pass authentication and which ones need attention before moving to a stricter policy
Where dmarcula comes in
DMARC reports usually arrive as XML files from many different mailbox providers. They are useful, but not pleasant to read manually.
Dmarcula collects the reports, parses the XML, and shows what is happening with your domain. Who is sending mails, what passes, what fails, and what need to be fixed before moving on to a stricter policy.