Free DMARC Analyzer & Policy Generator

Overview

DMARC is an email authentication protocol that builds on SPF and DKIM to prevent email spoofing and phishing attacks. It allows domain owners to specify what should happen when an email fails SPF or DKIM checks, and provides detailed reporting on email authentication results.

How DMARC Works

1. Email Received: A receiving mail server gets an email claiming to be from your domain
2. SPF/DKIM Check: The server checks if the email passes SPF and/or DKIM authentication
3. DMARC Lookup: The server retrieves your DMARC policy from DNS at _dmarc.yourdomain.com
4. Alignment Check: DMARC verifies that the domain in the From: header aligns with the domains in SPF/DKIM
5. Policy Application: Based on your policy (none/quarantine/reject), the server takes action on failed messages
6. Reporting: The receiving server sends aggregate reports back to addresses specified in your DMARC record

DMARC Policy Modes

Understanding DMARC Alignment

DMARC alignment ensures that the domain in the email's From: header matches the domain authenticated by SPF or DKIM. There are two alignment modes:

• Relaxed (r): Subdomains are allowed to match. For example, mail.example.com aligns with example.com. This is the default and recommended for most organizations.
• Strict (s): Only exact domain matches are allowed. mail.example.com would NOT align with example.com. Use this for maximum security when you have full control over all sending sources.

DMARC Reporting

DMARC provides two types of reports that help you monitor your email authentication:

Gradual DMARC Rollout Strategy

Implementing DMARC requires a careful, phased approach to avoid blocking legitimate email. Here's the recommended rollout strategy:

Common DMARC Issues

• No DMARC Record: Without DMARC, you have no control over how receivers handle spoofed emails from your domain
• Policy Too Weak: p=none provides visibility but no protection against spoofing
• Missing SPF/DKIM: DMARC requires at least one of SPF or DKIM to pass with alignment
• Alignment Failures: From: header domain doesn't match SPF or DKIM authenticated domains
• Subdomain Gaps: No subdomain policy (sp=) leaves subdomains vulnerable
• No Reporting: Missing rua= means you won't receive aggregate reports to monitor authentication
• Too Aggressive Rollout: Jumping directly to p=reject can block legitimate email if sources aren't properly authenticated

DMARC Best Practices

• Always start with p=none and monitor reports for at least 2-4 weeks
• Set up aggregate reporting (rua=) to receive daily authentication summaries
• Use the pct= tag for gradual rollout (e.g., pct=25 applies policy to 25% of messages)
• Configure a subdomain policy (sp=) to protect subdomains from spoofing
• Use relaxed alignment (aspf=r, adkim=r) unless you have specific security requirements
• Ensure all legitimate sending sources have SPF and DKIM properly configured
• Work towards p=reject as your end goal for maximum protection
• Regularly review DMARC reports to identify authentication issues
• Document all authorized email sending sources and their authentication methods
• Consider using a DMARC reporting service to parse and analyze aggregate reports

DMARC Record Example