DMARC prevents domain spoofing. Set up a DMARC record to protect your domain and receive spoofing reports.
Prerequisites
Before you begin, learn about What is DNS?
What is DMARC
Domain-based Message Authentication, Reporting, and Conformance (DMARC) is an email authentication protocol that prevents domain spoofing and provides reports on spoofing attempts.
When a recipient's Mail Transfer Agent (MTA) supports DMARC, it validates emails from your domain. Failed checks generate a report sent to the address in your DMARC record.
Configure DMARC
1. Configure an SPF record before setting up DMARC, such as "v=spf1 include the following:spf.qiye.aliyun.com -all". What is an SPF record? How do I add and query one?.
2. After you configure the SPF record, set up the following DMARC record:
|
Manage domain name resolution |
Record type |
Priority |
Record value |
|
_dmarc |
TXT |
- |
v=DMARC1; p=quarantine; rua=mailto:a***@example.net; ruf=mailto:a***@example.net |
-
Use an organizational email address that can send and receive emails, such as a subdomain mailbox. Addresses from other organizations may not receive DMARC reports, depending on recipient policy.
-
If your domain name was not purchased from Alibaba Cloud, consult your domain name service provider for instructions on how to add the record.
Add a DMARC record
The following example uses Alibaba Cloud DNS:
1. Log on to the Alibaba Cloud DNS console, find your domain name, and click DNS Settings.
2. On the DNS Settings page, click Add Record, enter the parameters, and click OK.
Example:
Record Type: TXT
Host Record: _dmarc
Example DMARC record:
Handle bounce email attacks
If an attacker spoofs your domain name to send emails, your mailbox may receive many bounce emails or auto-replies.
Recommended actions
1. Verify that the SPF record is configured correctly.
2. Configure a DMARC record with p=quarantine. Monitor the returned reports. If spoofing is confirmed, change p to reject.
3. Use a dedicated organizational mailbox to receive DMARC reports, as report volume can be high.
Parameter descriptions
-
p=none: Allows all emails from your domain name to pass, even if they fail DMARC validation.
Example:
v=DMARC1;p=none;rua=mailto:a***@example.net;ruf=mailto:a***@example.net-
p=quarantine: Moves failing emails to the junk folder. Use the pct parameter (default: 100) to set the quarantine percentage.
Example:
v=DMARC1;p=quarantine;pct=15;rua=mailto:a***@example.net;ruf=mailto:a***@example.net-
p=reject: Enforces a strict rejection policy. Rejects all emails that fail identity verification.
Example:
v=DMARC1;p=reject;rua=mailto:a***@example.net;ruf=mailto:a***@example.netrua: Receives aggregate reports from recipient mail servers. Recommended.
ruf: Receives forensic reports on rejected emails from recipient mail servers.
In relay scenarios, the actual sender (mailfrom) differs from the displayed sender (from).
If the from domain has a DMARC policy of reject, relaying is not allowed.
Recipients that strictly enforce DMARC will likely reject the email.