352 lines
18 KiB
TypeScript
352 lines
18 KiB
TypeScript
import React from 'react';
|
|
import {GuideLayout, InfoBox} from '../../components/guides';
|
|
import {CodeBlock} from '../../components/CodeBlock';
|
|
import Link from 'next/link';
|
|
|
|
export default function WhatIsDMARC() {
|
|
return (
|
|
<GuideLayout
|
|
title="What is DMARC? Email Policy & Reporting Explained"
|
|
description="Learn how DMARC works with SPF and DKIM to protect your domain from email spoofing. Complete setup guide with policy examples."
|
|
lastUpdated="2025-12-20"
|
|
readTime="9 min"
|
|
canonical="https://www.useplunk.com/guides/what-is-dmarc"
|
|
>
|
|
{/* Introduction */}
|
|
<section id="introduction" className="mb-12">
|
|
<p className="text-neutral-700 leading-relaxed">
|
|
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol
|
|
that builds on SPF and DKIM to protect your domain from email spoofing and phishing.
|
|
</p>
|
|
<p className="mt-4 text-neutral-700 leading-relaxed">
|
|
While SPF and DKIM authenticate emails, DMARC tells receiving servers what to do when authentication fails and
|
|
provides reports about your email authentication status.
|
|
</p>
|
|
</section>
|
|
|
|
{/* How DMARC Works */}
|
|
<section id="how-dmarc-works" className="mb-12">
|
|
<h2 className="text-3xl font-bold text-neutral-900 mb-6">How DMARC Works</h2>
|
|
<p className="text-neutral-700 leading-relaxed mb-6">
|
|
DMARC adds a policy layer on top of SPF and DKIM. Here's how it works:
|
|
</p>
|
|
|
|
<div className="space-y-6 mb-8">
|
|
<div className="border-l-4 border-neutral-900 pl-6">
|
|
<h3 className="text-xl font-semibold text-neutral-900 mb-2">1. Email Authentication</h3>
|
|
<p className="text-neutral-700">
|
|
When an email is received, the server first checks SPF and DKIM authentication. At least one of these must
|
|
pass for DMARC to pass.
|
|
</p>
|
|
</div>
|
|
|
|
<div className="border-l-4 border-neutral-900 pl-6">
|
|
<h3 className="text-xl font-semibold text-neutral-900 mb-2">2. Alignment Check</h3>
|
|
<p className="text-neutral-700">
|
|
DMARC checks if the domain in the "From" header aligns with the domain that passed SPF or DKIM. This is
|
|
called "identifier alignment."
|
|
</p>
|
|
</div>
|
|
|
|
<div className="border-l-4 border-neutral-900 pl-6">
|
|
<h3 className="text-xl font-semibold text-neutral-900 mb-2">3. Policy Application</h3>
|
|
<p className="text-neutral-700">
|
|
If authentication and alignment pass, the email is delivered. If they fail, the receiving server follows
|
|
your DMARC policy: none (monitor only), quarantine (send to spam), or reject (block completely).
|
|
</p>
|
|
</div>
|
|
|
|
<div className="border-l-4 border-neutral-900 pl-6">
|
|
<h3 className="text-xl font-semibold text-neutral-900 mb-2">4. Reporting</h3>
|
|
<p className="text-neutral-700">
|
|
Receiving servers send daily reports to your specified email address, showing authentication results for
|
|
all emails claiming to be from your domain.
|
|
</p>
|
|
</div>
|
|
</div>
|
|
|
|
<InfoBox type="info" title="DMARC Requires SPF or DKIM">
|
|
<p>
|
|
DMARC doesn't work alone—you must have SPF and/or DKIM configured first. DMARC builds on these protocols to
|
|
provide policy enforcement and reporting.
|
|
</p>
|
|
</InfoBox>
|
|
</section>
|
|
|
|
{/* DMARC Record Syntax */}
|
|
<section id="dmarc-record-syntax" className="mb-12">
|
|
<h2 className="text-3xl font-bold text-neutral-900 mb-6">DMARC Record Syntax</h2>
|
|
<p className="text-neutral-700 leading-relaxed mb-6">
|
|
A DMARC record is a TXT record published at <code>_dmarc.yourdomain.com</code>. Here's an example:
|
|
</p>
|
|
|
|
<CodeBlock
|
|
language="dns"
|
|
title="Example DMARC Record"
|
|
code={`_dmarc.yourdomain.com IN TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected]; pct=100; adkim=r; aspf=r"
|
|
|
|
# Breaking down the components:
|
|
# v=DMARC1 -> DMARC version
|
|
# p=quarantine -> Policy (none, quarantine, or reject)
|
|
# rua=mailto:[email protected] -> Aggregate report email
|
|
# ruf=mailto:[email protected] -> Forensic report email
|
|
# pct=100 -> Percentage of mail to apply policy (100%)
|
|
# adkim=r -> DKIM alignment mode (r=relaxed, s=strict)
|
|
# aspf=r -> SPF alignment mode (r=relaxed, s=strict)`}
|
|
/>
|
|
|
|
<div className="mt-8 space-y-6">
|
|
<div>
|
|
<h3 className="text-lg font-semibold text-neutral-900 mb-3">DMARC Policy Tags</h3>
|
|
<div className="rounded-xl border border-neutral-200 overflow-hidden">
|
|
<table className="w-full">
|
|
<thead className="bg-neutral-50">
|
|
<tr>
|
|
<th className="px-6 py-3 text-left text-sm font-semibold text-neutral-900">Tag</th>
|
|
<th className="px-6 py-3 text-left text-sm font-semibold text-neutral-900">Description</th>
|
|
<th className="px-6 py-3 text-left text-sm font-semibold text-neutral-900">Required</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody className="divide-y divide-neutral-200">
|
|
<tr>
|
|
<td className="px-6 py-4 font-mono text-sm text-neutral-900">v</td>
|
|
<td className="px-6 py-4 text-sm text-neutral-700">DMARC version (always DMARC1)</td>
|
|
<td className="px-6 py-4 text-sm text-neutral-700">Yes</td>
|
|
</tr>
|
|
<tr>
|
|
<td className="px-6 py-4 font-mono text-sm text-neutral-900">p</td>
|
|
<td className="px-6 py-4 text-sm text-neutral-700">Policy: none, quarantine, or reject</td>
|
|
<td className="px-6 py-4 text-sm text-neutral-700">Yes</td>
|
|
</tr>
|
|
<tr>
|
|
<td className="px-6 py-4 font-mono text-sm text-neutral-900">rua</td>
|
|
<td className="px-6 py-4 text-sm text-neutral-700">Aggregate report email address</td>
|
|
<td className="px-6 py-4 text-sm text-neutral-700">Recommended</td>
|
|
</tr>
|
|
<tr>
|
|
<td className="px-6 py-4 font-mono text-sm text-neutral-900">ruf</td>
|
|
<td className="px-6 py-4 text-sm text-neutral-700">Forensic report email address</td>
|
|
<td className="px-6 py-4 text-sm text-neutral-700">Optional</td>
|
|
</tr>
|
|
<tr>
|
|
<td className="px-6 py-4 font-mono text-sm text-neutral-900">pct</td>
|
|
<td className="px-6 py-4 text-sm text-neutral-700">Percentage of mail to filter (0-100)</td>
|
|
<td className="px-6 py-4 text-sm text-neutral-700">Optional</td>
|
|
</tr>
|
|
<tr>
|
|
<td className="px-6 py-4 font-mono text-sm text-neutral-900">sp</td>
|
|
<td className="px-6 py-4 text-sm text-neutral-700">Policy for subdomains</td>
|
|
<td className="px-6 py-4 text-sm text-neutral-700">Optional</td>
|
|
</tr>
|
|
<tr>
|
|
<td className="px-6 py-4 font-mono text-sm text-neutral-900">adkim</td>
|
|
<td className="px-6 py-4 text-sm text-neutral-700">DKIM alignment: r (relaxed) or s (strict)</td>
|
|
<td className="px-6 py-4 text-sm text-neutral-700">Optional</td>
|
|
</tr>
|
|
<tr>
|
|
<td className="px-6 py-4 font-mono text-sm text-neutral-900">aspf</td>
|
|
<td className="px-6 py-4 text-sm text-neutral-700">SPF alignment: r (relaxed) or s (strict)</td>
|
|
<td className="px-6 py-4 text-sm text-neutral-700">Optional</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</section>
|
|
|
|
{/* DMARC Policies */}
|
|
<section id="dmarc-policies" className="mb-12">
|
|
<h2 className="text-3xl font-bold text-neutral-900 mb-6">Understanding DMARC Policies</h2>
|
|
<p className="text-neutral-700 leading-relaxed mb-6">
|
|
DMARC offers three policy levels. You should implement them progressively:
|
|
</p>
|
|
|
|
<div className="space-y-6">
|
|
<div className="rounded-xl border-2 border-blue-200 bg-blue-50 p-6">
|
|
<div className="flex items-start gap-4">
|
|
<div className="flex h-10 w-10 shrink-0 items-center justify-center rounded-full bg-blue-600 text-white font-bold">
|
|
1
|
|
</div>
|
|
<div>
|
|
<h3 className="text-xl font-semibold text-blue-900 mb-2">p=none (Monitor Mode)</h3>
|
|
<p className="text-neutral-700 mb-3">
|
|
No action is taken on failed emails—they're still delivered. Use this initially to monitor your email
|
|
authentication without affecting delivery.
|
|
</p>
|
|
<CodeBlock language="dns" code={`v=DMARC1; p=none; rua=mailto:[email protected]`} showCopy={false} />
|
|
<p className="text-sm text-neutral-600 mt-3">
|
|
<strong>Best for:</strong> Initial setup, gathering data, testing configuration
|
|
</p>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div className="rounded-xl border-2 border-amber-200 bg-amber-50 p-6">
|
|
<div className="flex items-start gap-4">
|
|
<div className="flex h-10 w-10 shrink-0 items-center justify-center rounded-full bg-amber-600 text-white font-bold">
|
|
2
|
|
</div>
|
|
<div>
|
|
<h3 className="text-xl font-semibold text-amber-900 mb-2">p=quarantine (Quarantine Failed Mail)</h3>
|
|
<p className="text-neutral-700 mb-3">
|
|
Emails that fail authentication are sent to spam/junk folders. This is a good middle ground that
|
|
protects your domain while minimizing delivery issues.
|
|
</p>
|
|
<CodeBlock
|
|
language="dns"
|
|
code={`v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100`}
|
|
showCopy={false}
|
|
/>
|
|
<p className="text-sm text-neutral-600 mt-3">
|
|
<strong>Best for:</strong> After monitoring, when you're confident in your setup
|
|
</p>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div className="rounded-xl border-2 border-red-200 bg-red-50 p-6">
|
|
<div className="flex items-start gap-4">
|
|
<div className="flex h-10 w-10 shrink-0 items-center justify-center rounded-full bg-red-600 text-white font-bold">
|
|
3
|
|
</div>
|
|
<div>
|
|
<h3 className="text-xl font-semibold text-red-900 mb-2">p=reject (Block Failed Mail)</h3>
|
|
<p className="text-neutral-700 mb-3">
|
|
Emails that fail authentication are completely rejected and not delivered. This provides maximum
|
|
protection but requires perfect configuration.
|
|
</p>
|
|
<CodeBlock
|
|
language="dns"
|
|
code={`v=DMARC1; p=reject; rua=mailto:[email protected]; pct=100`}
|
|
showCopy={false}
|
|
/>
|
|
<p className="text-sm text-neutral-600 mt-3">
|
|
<strong>Best for:</strong> Mature implementations with complete authentication coverage
|
|
</p>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<InfoBox type="warning" title="Progressive Implementation">
|
|
<p>
|
|
Always start with <code>p=none</code> and monitor for at least 2-4 weeks. Review DMARC reports, fix any
|
|
authentication issues, then gradually move to <code>p=quarantine</code> and finally <code>p=reject</code>.
|
|
</p>
|
|
</InfoBox>
|
|
</section>
|
|
|
|
{/* Setting Up DMARC */}
|
|
<section id="setting-up-dmarc" className="mb-12">
|
|
<h2 className="text-3xl font-bold text-neutral-900 mb-6">How to Set Up DMARC</h2>
|
|
|
|
<div className="space-y-4 mb-8">
|
|
<div className="flex items-start gap-4 p-6 rounded-xl bg-neutral-50 border border-neutral-200">
|
|
<div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-neutral-900 text-white text-sm font-bold">
|
|
1
|
|
</div>
|
|
<div>
|
|
<h3 className="font-semibold text-neutral-900 mb-2">Ensure SPF and DKIM are Working</h3>
|
|
<p className="text-neutral-700">
|
|
DMARC requires either SPF or DKIM (or both) to be configured. Verify these are working before
|
|
implementing DMARC.
|
|
</p>
|
|
</div>
|
|
</div>
|
|
|
|
<div className="flex items-start gap-4 p-6 rounded-xl bg-neutral-50 border border-neutral-200">
|
|
<div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-neutral-900 text-white text-sm font-bold">
|
|
2
|
|
</div>
|
|
<div>
|
|
<h3 className="font-semibold text-neutral-900 mb-2">Create a Mailbox for Reports</h3>
|
|
<p className="text-neutral-700">
|
|
Set up an email address to receive DMARC reports (e.g., [email protected]). These reports can be
|
|
large and frequent, so use a dedicated mailbox.
|
|
</p>
|
|
</div>
|
|
</div>
|
|
|
|
<div className="flex items-start gap-4 p-6 rounded-xl bg-neutral-50 border border-neutral-200">
|
|
<div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-neutral-900 text-white text-sm font-bold">
|
|
3
|
|
</div>
|
|
<div>
|
|
<h3 className="font-semibold text-neutral-900 mb-2">Create Your DMARC Record</h3>
|
|
<p className="text-neutral-700 mb-3">Start with a monitoring-only policy:</p>
|
|
<CodeBlock language="dns" code={`v=DMARC1; p=none; rua=mailto:[email protected]; pct=100`} />
|
|
</div>
|
|
</div>
|
|
|
|
<div className="flex items-start gap-4 p-6 rounded-xl bg-neutral-50 border border-neutral-200">
|
|
<div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-neutral-900 text-white text-sm font-bold">
|
|
4
|
|
</div>
|
|
<div>
|
|
<h3 className="font-semibold text-neutral-900 mb-2">Add to DNS</h3>
|
|
<p className="text-neutral-700">
|
|
Add the DMARC record as a TXT record at <code>_dmarc.yourdomain.com</code>
|
|
</p>
|
|
</div>
|
|
</div>
|
|
|
|
<div className="flex items-start gap-4 p-6 rounded-xl bg-neutral-50 border border-neutral-200">
|
|
<div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-neutral-900 text-white text-sm font-bold">
|
|
5
|
|
</div>
|
|
<div>
|
|
<h3 className="font-semibold text-neutral-900 mb-2">Monitor Reports</h3>
|
|
<p className="text-neutral-700">
|
|
Review DMARC reports for 2-4 weeks. Look for failed authentications and identify any legitimate sources
|
|
that need SPF/DKIM configuration.
|
|
</p>
|
|
</div>
|
|
</div>
|
|
|
|
<div className="flex items-start gap-4 p-6 rounded-xl bg-neutral-50 border border-neutral-200">
|
|
<div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-neutral-900 text-white text-sm font-bold">
|
|
6
|
|
</div>
|
|
<div>
|
|
<h3 className="font-semibold text-neutral-900 mb-2">Gradually Increase Policy</h3>
|
|
<p className="text-neutral-700">
|
|
Once confident, update to <code>p=quarantine</code>, monitor again, then move to <code>p=reject</code>{' '}
|
|
if desired.
|
|
</p>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</section>
|
|
|
|
{/* Related Guides */}
|
|
<section id="related-guides" className="mb-12">
|
|
<h2 className="text-3xl font-bold text-neutral-900 mb-6">Related Email Authentication Guides</h2>
|
|
<div className="grid gap-4 md:grid-cols-3">
|
|
<Link
|
|
href="/guides/what-is-dkim"
|
|
className="block rounded-xl border border-neutral-200 bg-white p-6 transition hover:border-neutral-300 hover:shadow-lg"
|
|
>
|
|
<h3 className="text-lg font-semibold text-neutral-900 mb-2">What is DKIM?</h3>
|
|
<p className="text-sm text-neutral-600">Learn how DKIM authenticates email content.</p>
|
|
</Link>
|
|
<Link
|
|
href="/guides/what-is-spf"
|
|
className="block rounded-xl border border-neutral-200 bg-white p-6 transition hover:border-neutral-300 hover:shadow-lg"
|
|
>
|
|
<h3 className="text-lg font-semibold text-neutral-900 mb-2">What is SPF?</h3>
|
|
<p className="text-sm text-neutral-600">Understand SPF records and server authorization.</p>
|
|
</Link>
|
|
<Link
|
|
href="/guides/email-deliverability"
|
|
className="block rounded-xl border border-neutral-200 bg-white p-6 transition hover:border-neutral-300 hover:shadow-lg"
|
|
>
|
|
<h3 className="text-lg font-semibold text-neutral-900 mb-2">Email Deliverability Guide</h3>
|
|
<p className="text-sm text-neutral-600">Complete guide to improving email deliverability.</p>
|
|
</Link>
|
|
</div>
|
|
</section>
|
|
</GuideLayout>
|
|
);
|
|
}
|