DMARC Explained: Alignment, Policies and Reports for the Security+ Exam

DMARC — Domain-based Message Authentication, Reporting and Conformance — is the layer that makes SPF and DKIM actually stop spoofing. On its own it authenticates nothing; it ties the other two to the address the recipient sees and tells receivers what to do when that fails.

The gap DMARC closes

This is the whole point, and it is the exam's favourite DMARC question.

SPF checks the envelope sender — the address used in the SMTP MAIL FROM command. DKIM verifies a signature associated with a signing domain. Neither of them looks at the From: header, which is the only address the user actually sees.

So an attacker can register their own domain, publish a perfectly valid SPF record for it, sign with DKIM for it, pass both checks — and set the visible From: header to your bank. Both mechanisms report success on a message that is entirely fraudulent.

DMARC requires alignment: the domain in the visible From: header must match the domain that passed SPF or DKIM. Without alignment, the message fails DMARC no matter how many underlying checks it passed.

Alignment modes

Alignment can be strict or relaxed, set separately for SPF and DKIM.

Relaxed (the default) requires the organisational domain to match, so mail.example.com aligns with example.com.

Strict requires an exact match, so mail.example.com does not align with example.com.

Relaxed is almost always the right choice, because legitimate mail commonly comes from subdomains and third-party platforms.

Note that DMARC passes if either SPF or DKIM passes with alignment. Both need not succeed — which matters for forwarded mail, where SPF breaks but an intact DKIM signature still carries the message.

The policies

Policy	Receiver action on failure
p=none	Deliver normally; send reports
p=quarantine	Treat as suspicious — usually spam folder
p=reject	Refuse the message outright

A minimal record published as a DNS TXT record at _dmarc.example.com:

v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100

Useful tags: rua for aggregate report address, ruf for forensic reports, pct to apply the policy to a percentage of mail during rollout, sp to set a different policy for subdomains, and adkim / aspf for alignment mode.

The deployment path

The sequence matters, and the exam asks about it because going straight to reject breaks legitimate mail.

Start at p=none. This changes nothing about delivery but starts the reports flowing. Run it long enough to see a full business cycle — monthly invoicing, quarterly mailings.

Read the aggregate reports to find every legitimate sender. Organisations reliably discover services they forgot: the CRM, the ticketing system, the payroll platform, a marketing tool someone signed up for.

Fix those senders by adding them to SPF or configuring DKIM signing.

Move to p=quarantine, optionally with pct to ramp gradually.

Then p=reject once reports show only illegitimate mail failing.

Rushing to reject sends your own invoices to nowhere, which is how DMARC projects get abandoned.

The reports

Aggregate reports (RUA) are XML summaries sent daily by receivers: sending IPs, message volumes, and SPF, DKIM and DMARC results. They contain no message content and are the operationally useful output.

Forensic reports (RUF) are per-message failure samples. Rarely sent now, because they may contain personal data and raise privacy concerns.

Aggregate reports are verbose XML, so most organisations use a processing service to make them readable.

What DMARC does not do

It protects your domain from being spoofed in the From: header. It does not stop an attacker using a lookalike domain — a typosquatted or homoglyph domain with its own valid DMARC record will pass everything. Nor does it protect against a genuinely compromised mailbox, where the mail really is from you.

Those gaps are why DMARC sits alongside user training, obfuscated-link detection and display-name checks rather than replacing them.

What to remember

DMARC requires alignment between the visible From: domain and the domain that passed SPF or DKIM — either one suffices. Policies are none, quarantine and reject, and the record lives at _dmarc.domain. Deploy through none, read the aggregate reports, fix legitimate senders, then tighten. DMARC does not stop lookalike domains or compromised accounts.

Related reading: SPF · DKIM · Obfuscated links