What DMARC Protects You From, and What It Does Not
This technical deep dive meticulously explains DMARC, clarifying its precise function in email authentication—proving if a sender is authorized for a visible domain—and debunking widespread misconceptions about its capabilities. It details what DMARC does protect against, like exact-domain spoofing, while highlighting critical areas where it offers no defense, such as lookalike domains or compromised mailboxes. The article is popular on HN because it provides essential, often misunderstood, information for anyone serious about email security and authentication.
The Lowdown
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is frequently misunderstood, often asked to perform tasks it wasn't designed for, like comprehensive spam or phishing filtering. This article clarifies that DMARC's true purpose, as defined by RFC 9989, is narrowly focused on verifying if the owner of the visible 'From' address authorized a message through aligned SPF or DKIM results. Understanding this precise scope is crucial to avoid a false sense of security.
- Email Authentication Basics: Email uses an 'envelope address' for routing (checked by SPF) and a 'visible From' address that users see. SPF (Sender Policy Framework) lists authorized sending servers for a domain, while DKIM (DomainKeys Identified Mail) provides a cryptographic signature to verify message integrity and sender domain.
- DMARC's Role: DMARC ties SPF and DKIM authentication back to the 'visible From' address, ensuring that the authentication source aligns with what the user perceives as the sender. It exists as a DNS TXT record, specifying policies like
p=reject(rejecting unauthenticated mail) andrua=for reporting. - How DMARC Passes: A message passes DMARC if either SPF or DKIM successfully authenticates and aligns with the visible From domain. Alignment can be 'relaxed' (default, e.g.,
mail.example.comaligns withexample.com) or 'strict' (domains must be identical). - What DMARC Protects: Its primary benefit is protecting against exact-domain spoofing, where an attacker attempts to send mail using your exact domain in the visible From address without proper authorization. It also provides valuable aggregate reports on email sent from your domain.
- Where DMARC Falls Short: DMARC does not protect against lookalike domains (
your-bank-support.com), display-name impersonation (e.g., 'Your Bank Security' with an unrelated email address), compromised mailboxes (legitimate infrastructure sending malicious mail), or authenticated but malicious domains. It is also not a spam filter and can be legitimately broken by forwarding or mailing lists. - Authentication vs. Trust: The core message is that DMARC establishes provenance (who authorized the message), not trust in the content or intent. Vendors implying DMARC 'stops phishing' mislead customers, leaving them vulnerable to attacks outside DMARC's scope.
The article concludes by emphasizing that DMARC is a powerful, specific tool for combating exact-domain spoofing and gaining visibility into sender activity. However, it's not a silver bullet for all email security challenges, and organizations need additional measures for comprehensive protection against the broader spectrum of email-based threats.