RFC 7489 — DMARC

Domain-based Message Authentication, Reporting, and Conformance (DMARC) — email authentication policy framework that builds on SPF and DKIM to provide domain-level protection against email spoofing.

Informational March 2015 ISO 27001

1. Introduction

▶

DMARC unifies SPF and DKIM authentication results with a domain-owner-defined policy. It tells receiving mail servers what to do when authentication fails and provides a reporting mechanism for visibility into email authentication across the internet.

ISO 27001 Relevance: A.8.12 (Data Leakage Prevention) — prevents domain spoofing attacks. A.8.16 (Monitoring Activities) — DMARC reports provide visibility into email authentication failures. A.8.21 (Security of Network Services) — comprehensive email service security.

2. DMARC Record

▶ 
  _dmarc.blacklabs.team IN TXT (
    "v=DMARC1; p=reject; rua=mailto:dmarc-reports@blacklabs.team;
     ruf=mailto:dmarc-forensics@blacklabs.team; pct=100; adkim=s; aspf=s" )

  Tags:
    p     — Policy: none | quarantine | reject
    rua   — Aggregate report URI
    ruf   — Forensic report URI
    pct   — Percentage of messages to apply policy
    adkim — DKIM alignment: s (strict) | r (relaxed)
    aspf  — SPF alignment: s (strict) | r (relaxed)

3. Authentication Flow

▶ 
  Incoming Email
       │
       ▼
  ┌─────────────┐     ┌──────────┐
  │ SPF Check   │────>│ Aligned? │
  └─────────────┘     └────┬─────┘
                           │
  ┌─────────────┐     ┌────▼─────┐
  │ DKIM Check  │────>│ Aligned? │
  └─────────────┘     └────┬─────┘
                           │
                      ┌────▼──────────┐
                      │ DMARC Policy  │
                      │ p=reject?     │
                      │ p=quarantine? │
                      │ p=none?       │
                      └────┬──────────┘
                           │
                      ┌────▼─────┐
                      │ Deliver  │
                      │ Quarantine│
                      │ Reject   │
                      └──────────┘

4. Reporting

▶

DMARC provides two types of reports:

  • Aggregate (rua): XML reports sent daily with statistics on authentication results — use for monitoring (A.8.16)
  • Forensic (ruf): Individual failure reports with message details — use for incident investigation (A.5.28)
Deployment Path: Start with p=none (monitor), analyze reports, fix authentication issues, then escalate to p=quarantine and finally p=reject.

5. Security Considerations

▶
  • Start monitoring: Deploy p=none first to avoid blocking legitimate email
  • Strict alignment: Use adkim=s and aspf=s for maximum protection
  • Subdomain policy: Set sp=reject to protect subdomains from spoofing
  • Third-party senders: Ensure all legitimate senders (marketing, CRM, etc.) are SPF/DKIM aligned before enforcing reject
  • Report analysis: Regularly analyze DMARC aggregate reports to detect unauthorized use of your domain