Manage DMARC records

This guide explains how to implement a DMARC policy for your email hosted by Infomaniak, which has become essential to prevent potential delivery malfunctions.

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an essential tool to enhance email security and protect your domain against fraud by verifying the authenticity of outgoing emails (through authentication mechanisms such as SPF and DKIM) and allowing you to define policies for handling unauthenticated emails.

DMARC exists to specify to other mail providers what they should do when they reject an email due to incorrect or missing SPF or DKIM. Domain owners can define DMARC policies, such as "reject," "quarantine," or "none," to specify how these "suspect" emails should be handled.

Example:

1. An email is sent from anna@domain.xyz to victor@yahoogle.abc
2. The Mail Service of domain.xyz has a DMARC configuration of reject at 100%
3. The Mail Service of yahoogle.abc is properly secured and performs SPF/DKIM/DMARC analysis of the email arriving from domain.xyz
4. If this analysis results in SPF or DKIM failure, then the Mail Service of yahoogle.abc will reject (thus delete) the message
5. It will send a report* by email if a reporting address is specified in the DMARC of domain.xyz

* These DMARC reports generated help you maintain and improve the security of your domain; you can identify any authentication errors and phishing attempts using your domain.

DMARC Policy and Acceptance Percentage

For the directives that can be given to recipient servers when a suspect message is detected, there are 3 policies (p = policy) that exist and can be refined with a percentage (pct):

none

With "p=none," no emails are rejected or quarantined based on DMARC verification. However, the reception percentage can be used to collect data on unauthenticated emails, indicating how many of these emails should be subjected to the DMARC policy. For example, "p=none; pct=10" means that 10% of unauthenticated emails will be subjected to the DMARC policy, while the remaining 90% will be accepted.

quarantine

With "p=quarantine," unauthenticated emails can be quarantined, but the reception percentage determines the proportion actually subjected to this policy. For example, "p=quarantine; pct=50" means that 50% of unauthenticated emails will be quarantined, while the remaining 50% will be accepted.

reject

With "p=reject," unauthenticated emails are rejected. The reception percentage determines the proportion of unauthenticated emails that will actually be rejected. For example, "p=reject; pct=20" means that 20% of unauthenticated emails will be rejected, while the remaining 80% will be accepted.

Create a DMARC Record

There are 2 ways to manage DMARC.

If you have a Mail Service with Infomaniak, the easiest way is to go to the Global Security tool to manage your DMARC security policy and reports.

But since the DMARC record is a type of DNS record, usually of type TXT, you can also manage it from the domain name's DNS zone:

1. Log in to the Infomaniak Manager (manager.infomaniak.com) from a web browser like Brave or Edge
2. Click on the icon at the top right of the interface (or navigate through the left side menu, for example)
3. Choose Domains (Web & Domain universe)
4. Click on the name of the relevant object in the displayed table
5. Click on DNS Zone in the left side menu
6. Click the button to add a record:
   
7. Click on the radio button DMARC to add a record 
8. Click the Next button
   
9. Leave (or add if necessary) the value _dmarc in the Source field
10. The Target field should contain the parameters you want to use, separated by ;:
    

    Tag Name	Purpose	Example
    v	Protocol version	v=DMARC1
    pct	Percentage of messages subjected to filtering	pct=20
    ruf	Forensic report URI	ruf=mailto:authfail@domain.xyz
    rua	Aggregate report URI	rua=mailto:aggrep@domain.xyz
    p	Policy for the organizational domain	p=quarantine
    sp	Policy for subdomains of the organizational domain	sp=reject
    adkim	DKIM alignment mode	adkim=s
    aspf	SPF alignment mode	aspf=r

    
    this can give, for example, v=DMARC1;p=reject;pct=100;rua=mailto:postmaster@dmarcdomain.com (source)
11. Leave the default value for the TTL
12. Click the Save button