Understanding DMARC and Email Security
Email Security: The Trifecta
Email authentication relies on three DNS records working together:
- SPF — Which servers are allowed to send email for your domain
- DKIM — Cryptographic signature verifying email integrity
- DMARC — Policy telling receivers what to do with unauthenticated email
The Problem
Without proper email authentication, anyone can send emails that appear to come from your domain. This enables:
- Phishing — Attackers impersonate your brand to steal customer credentials
- CEO fraud — Emails appearing to come from executives requesting wire transfers
- Reputation damage — Your domain gets blacklisted or flagged as spam
Setting Up SPF
SPF (Sender Policy Framework) uses a DNS TXT record to list authorized mail servers:
v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all
The ~all at the end means "soft fail" — emails from unauthorized servers are marked but not rejected. Once you're confident in your configuration, switch to -all (hard fail).
Setting Up DKIM
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email:
- Generate a public/private key pair from your email provider
- Publish the public key as a DNS TXT record (e.g.,
google._domainkey.yourdomain.com) - Your email server signs outgoing emails with the private key
Setting Up DMARC
DMARC ties SPF and DKIM together and tells receivers what to do when authentication fails:
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100; fo=1
Policy levels:
| Policy | Meaning | Recommended For |
|---|---|---|
p=none | Monitor only, no action taken | Initial deployment |
p=quarantine | Mark as spam | Transition |
p=reject | Reject the email entirely | Mature setup |
Testing with Sentinel
Use Sentinel's free DMARC analyzer to check your domain's email authentication:
- Is SPF configured?
- Is DKIM signing active?
- What's the DMARC policy? (reject is best)
- Any configuration errors in the DNS records?
Summary
Email authentication is not optional. Start with SPF, add DKIM for integrity, and wrap it all with DMARC's p=reject policy. Sentinel's DNS scan checks all three in seconds.