Talk to us

4. Deliverability

What is DMARC?

A DMARC policy is a DNS record you publish for your domain. It names what receiving servers should do with a message that claims your domain but fails the SPF and DKIM checks, and where they should send reports on what they saw.

The parts

  1. Alignment is the testDMARC passes when SPF or DKIM passes and the domain it checked lines up with the domain in the visible From address.
  2. The policy is a requestp= takes none, quarantine or reject. None asks for no special action, quarantine asks receivers to treat failures as suspicious, reject asks them to refuse the mail.
  3. Reports show what is happeningThe rua tag names an address that receives aggregate reports, so you see which servers send as your domain and whether they pass.
  4. It lives at _dmarcThe record is a TXT entry at _dmarc.yourdomain, one per domain.

A rollout at tallowcreek-mail.example

Tallow Creek Robotics is invented. It starts with a monitoring record, reads the reports, then tightens the policy in steps.

By hand

  1. Stage one, p=none: publish v=DMARC1; p=none; rua=mailto:dmarc@tallowcreek-mail.example and read the aggregate reports. Mail receivers asked for no action while the company learns who sends as its domain.
  2. The first report covers 4,200 messages. 4,158 passed with alignment, which is 99%. The 42 that failed are traced to one forgotten sending tool, which is then fixed.
  3. Stage two, p=quarantine: once the reports show only expected failures, change the policy so receivers treat the rest as suspicious. The pct tag can apply it to a share of mail first.
  4. Stage three, p=reject: when quarantine shows no surprises, ask receivers to refuse mail that fails alignment.
PartValueWhat it means
Name_dmarc.tallowcreek-mail.exampleWhere the TXT record lives.
vDMARC1The version tag. It has to read DMARC1 for receivers to treat the record as a policy.
pnonePolicy: ask for no special action while you watch.
ruamailto:dmarc@tallowcreek-mail.exampleAddress that receives aggregate reports.

The starting record for tallowcreek-mail.example, broken into parts. ColdMeetings lists p=none as the starting record.

How to apply it

  1. Make sure SPF and DKIM both pass for every service that sends as the domain.
  2. Publish a p=none record with an rua address and read the reports for a few weeks.
  3. Fix any legitimate sender that fails alignment, then move to p=quarantine.
  4. Move to p=reject once quarantine runs without surprises, and keep reading the reports.

Mistakes to avoid

  • Jumping straight to p=reject before the reports show who sends as the domain.
  • Publishing a record with no rua address, so nothing is reported back.
  • Forgetting subdomains and the tools that send from them.

SPF

SPF, short for Sender Policy Framework, is a DNS TXT record on your domain that lists the servers allowed to send mail using that domain.

Read more

DKIM

DKIM, short for DomainKeys Identified Mail, signs each outgoing message with a private key held by the sender.

Read more

Sender reputation

Sender reputation is the running record a mailbox provider keeps about a sending domain or address, built from how recipients and receiving systems treated its past mail.

Read more

Questions

Is DMARC required?
Yahoo asks bulk senders to publish a valid DMARC policy of at least p=none and have DMARC pass. Google asks senders of 5,000 or more messages a day to set up DMARC with alignment.
Does p=none protect my domain?
Not by itself. It requests no action and gives you reports. Protection comes when you move to quarantine or reject.
Where do the reports go?
To the address in the rua tag. They are machine-readable summaries, so many teams read them through a reporting tool.
Does the one-click unsubscribe standard relate to DMARC?
They are separate. RFC 8058 covers the List-Unsubscribe headers that let a person leave a list in one step; DMARC covers who may send as your domain.

Sources

Tell us what you sell and who buys it

What you sell

Who buys it

The button opens a draft in your own mail app. Nothing is sent from this page.

hello@coldmeetings.comEmail us
  • Software companies
  • Agencies
  • Service businesses