What Is DMARC?
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol that builds on SPF and DKIM to give domain owners control over how their email is handled when it fails authentication checks. It helps protect your domain from being used in email spoofing and phishing attacks.
Trusted Sender Score, a free service by Zulu Labs Inc, provides tools and guidance to help organizations adopt DMARC effectively — improving email deliverability while safeguarding brand reputation.
DMARC Implementation Phases
1. Assess
Audit your current email ecosystem. Identify all sending sources, including third-party services, marketing platforms, and internal applications that send mail on your domain's behalf.
2. Deploy SPF & DKIM
Ensure Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) are correctly configured for every legitimate sending source. These foundational protocols are prerequisites for DMARC.
3. Publish a Monitor-Only Policy
Start with a p=none DMARC policy. This collects forensic and aggregate reports without affecting delivery, letting you identify unauthorized senders before enforcement begins.
4. Analyze Reports
Review DMARC aggregate and forensic reports to understand who is sending email on your behalf. Identify anomalies, misconfigurations, and potential spoofing attempts.
5. Move to Quarantine
Gradually shift to p=quarantine, directing unauthenticated messages to recipients' spam folders. Monitor closely and adjust as needed.
6. Enforce Reject
Once confident that all legitimate sources are authenticated, move to p=reject. Unauthenticated email is now blocked outright, providing full anti-spoofing protection.
Best Practices
- Start small. Begin with a single subdomain or low-volume domain before rolling out organization-wide.
- Use reporting tools. Leverage DMARC report analyzers to make sense of XML aggregate data — manual parsing is impractical at scale.
- Engage stakeholders early. Marketing, IT, and third-party vendors all need to be aligned for a smooth deployment.
- Monitor continuously. DMARC is not a one-time project. Ongoing monitoring catches new sending sources and configuration drift.
- Combine with BIMI. Once at p=reject, consider Brand Indicators for Message Identification (BIMI) to display your logo in supporting inboxes.
Common Pitfalls
- Skipping the monitoring phase. Jumping straight to p=reject can block legitimate email and disrupt business operations.
- Overlooking third-party senders. SaaS platforms, CRMs, and marketing tools often send on your behalf — each must be accounted for in SPF and DKIM.
- Neglecting subdomains. Attackers often target subdomains that lack DMARC protection. Apply policies to your organizational domain and consider subdomain coverage.
- Ignoring report data. Collecting reports without acting on them defeats the purpose. Schedule regular reviews.