DMARC

SPF authenticates the envelope (MAIL FROM). DKIM authenticates the message body. DMARC (RFC 7489) ties them to the user-visible From: header.

Why? Spammers can:

• Use a different domain in MAIL FROM (passes their own SPF) but a victim domain in From:.
• Display "[email protected]" in the user's email client but actually be from anywhere.

DMARC's rule: at least one of SPF or DKIM must:

1. Pass authentication.
2. Have its domain ALIGN with the From: domain.

DNS:

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=reject; rua=mailto:[email protected]; pct=100"

• p: policy on failure (none, quarantine, reject).
• rua: aggregate report address (daily summaries).
• ruf: forensic report address (per-failure).
• pct: percentage of failures to apply policy to (rampable).
• aspf, adkim: alignment mode (relaxed/strict).
• sp: subdomain policy.

Workflow:

1. Receiver checks SPF on MAIL FROM and DKIM on body.
2. Computes alignment: SPF.domain matches From.domain? DKIM.d matches From.domain?
3. If neither aligns + passes → DMARC fail.
4. Apply policy: none (just report), quarantine (spam folder), reject.

Aggregate reports: receivers send daily XML reports back to rua address. Sender domain owners learn:

• Who's sending mail claiming to be them.
• Pass/fail rates.
• Authorized vs unauthorized senders.

Standard rollout:

1. Publish p=none + rua. Collect data.
2. Identify legit senders not yet aligned (e.g., third-party email service). Add SPF includes / DKIM keys.
3. Move to p=quarantine for some percentage.
4. Move to p=reject after no false positives for weeks.

Modern reality: Gmail and Yahoo (2024) require DMARC for bulk senders. Without it, mail to Gmail goes to spam.