DMARC, explained in plain English

You have probably heard of DMARC. You probably know it has something to do with email. You probably also suspect it's more complicated than it needs to be. Here is the non-RFC version.

The short version

DMARC is a small text record you publish in your DNS. It tells the internet what to do with emails that claim to come from your domain but can't prove it.

If you don't have DMARC, here's what happens:

From: [email protected] To: [email protected] Subject: URGENT — wire transfer approval

Hi team, I'm on the plane. Please wire $48,000 to the attached account for the new supplier contract.

The email did not come from your CEO. It came from an attacker in Lagos. Without DMARC, most inboxes will deliver it. With DMARC at p=quarantine or p=reject, it goes to spam or is bounced entirely.

The three pieces

• SPF says which servers are allowed to send email for your domain.
• DKIM cryptographically signs your outgoing email so recipients can verify it came from you.
• DMARC ties the two together and tells inboxes what to do when either check fails.

All three live in your DNS as TXT records. Together, they make email impersonation of your brand effectively impossible.

Setting up DMARC, the minimum viable version

_dmarc.yourcompany.com  TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]"

That's it. The rua= address will start receiving daily aggregate reports from every major mailbox provider telling you exactly which emails claiming to be from your domain are failing authentication.

After two weeks of reports, you'll know which of your legitimate senders (CRM, HubSpot, Mailchimp) need to be added to your SPF record, and you can tighten to p=reject with confidence.

What happens if I just leave p=none?

You get the reports but none of the protection. p=none tells inboxes "log these but deliver them anyway." It is the email equivalent of putting a "beware of dog" sign on a house that has no dog.