Mail: DMARC - Protection against Spoofing and Phishing

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a email authentication protocolwhich protects domains against:

• email address impersonation (spoofing),
• phishing attacks,
• unauthorised use of the domain for sending e-mails.

DMARC works with two other message authentication mechanisms:

• SPF (Sender Policy Framework) - determines which servers can send emails on behalf of a domain.
• DKIM (DomainKeys Identified Mail) - a cryptographic signature in the message to confirm the authenticity of the sender.

1. the recipient server (e.g. Gmail, Outlook) receives the email message. 2. checks that the message:

• has passed the SPF,
• passed the DKIM,
• and whether the sender is aligned with the domain (i.e. the so-called „alignment”).

3. based on the result, the server checks DMARC policywhich is set by the sender's domain. 4. depending on the policy (`none`, `quarantine`, `reject`), the message is:

• accepted,
• marked as spam,
• or rejected altogether.

A DMARC record is TXT record, added to the DNS zone of a domain, e.g.:

_dmarc.ostrowski.net.pl. IN TXT "v=DMARC1; p=quarantine; rua=mailto\:kacper\@ostrowski.net.pl

* Monitoring mode. * Takes no action against unauthorised messages. * Used to collect reports and verify SPF/DKIM configuration. * Recommended as a first step.

* Sends suspicious messages to the folder SPAM/JUNK. * Protection against phishing - but does not block messages completely. * Good compromise between security and risk of false positives. * Usually used as a second step before full rejection (`reject`).

* Strongest policy - completely rejects messages that fail the tests. * Provides maximum protection against spoofing. * Recommended only whenwhen:

• SPF and DKIM are correctly configured,
• You have full control over all servers sending messages on behalf of the domain.

v=DMARC1; p=none; rua=mailto\:kacper\@ostrowski.net.pl

v=DMARC1; p=quarantine; rua=mailto\:kacper\@ostrowski.net.pl; fo=1

v=DMARC1; p=reject; rua=mailto\:kacper\@ostrowski.net.pl; fo=1

• rua - summary reports (once a day), in XML format, showing SPF/DKIM/DMARC statistics.
• ruf - detailed reports (if supported by the recipient), containing copies of problematic messages.

Reports can be analysed manually or with tools such as:

• https://dmarcian.com/
• https://easydmarc.com/
• https://mail-tester.com/
• https://mxtoolbox.com/

1. Create and verify SPF and DKIM. 2. Add DMARC record with `p=none` and monitor reports. 3. after a few days/weeks:

• if legitimate messages pass tests,
• and reports show no errors,

4. Change policy to `p=quarantine`.. 5. after the next testing phase, go to `p=reject`. (full protection).

DMARC is a key component of email security. It enables the domain owner to:

• reputation protection,
• prevention of spoofing and phishing,
• collection of diagnostic data,
• control over how unauthorised messages are handled.

Full protection requires correct configuration SPF, DKIM and a well-chosen DMARC policy.