Article
Set up DMARC to validate email in Microsoft 365
learn.microsoft.com
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
You enable DMARC for a domain by creating a TXT record in DNS. DMARC validation of an email message involves the following elements: “A message passes DMARC if one or both of the described SPF or DKIM checks pass.” DMARC policy: Specifies what to do with messages that fail DMARC (reject, quarantine, or no instruction).
You enable DMARC for a domain by creating a TXT record in DNS. DMARC validation of an email message involves the following elements: “The domains in the MAIL FROM and From addresses in the message are aligned.” DMARC policy: Specifies what to do with messages that fail DMARC (reject, quarantine, or no instruction).
You enable DMARC for a domain by creating a TXT record in DNS. DMARC validation of an email message involves the following elements: “DMARC uses the result from DKIM to verify the domain that signed the message (the d= value in a DKIM-Signature header field as validated by the s= selector value) aligns with the domain in the From address.” DMARC policy: Specifies what to do with messages that fail DMARC (reject, quarantine, or no instruction).
You enable DMARC for a domain by creating a TXT record in DNS. DMARC validation of an email message involves the following elements: “The MAIL FROM address: The email address used in the transmission of the message between SMTP email servers.” DMARC policy: Specifies what to do with messages that fail DMARC (reject, quarantine, or no instruction).
You enable DMARC for a domain by creating a TXT record in DNS. DMARC validation of an email message involves the following elements: “The From address: The email address in the From header field shown as the message sender in email clients.” DMARC policy: Specifies what to do with messages that fail DMARC (reject, quarantine, or no instruction).
You enable DMARC for a domain by creating a TXT record in DNS. DMARC validation of an email message involves the following elements: “The message came from an authorized source for the domain used in the MAIL FROM address (the basic requirement of SPF).” DMARC policy: Specifies what to do with messages that fail DMARC (reject, quarantine, or no instruction).
You enable DMARC for a domain by creating a TXT record in DNS. DMARC validation of an email message involves the following elements: “The domains in the MAIL FROM and From addresses in the message are aligned.” DMARC policy: Specifies what to do with messages that fail DMARC (reject, quarantine, or no instruction).
You enable DMARC for a domain by creating a TXT record in DNS. DMARC validation of an email message involves the following elements: “Verify the domains in the MAIL FROM and FROM addresses align:” DMARC policy: Specifies what to do with messages that fail DMARC (reject, quarantine, or no instruction).
Domain-based Message Authentication, Reporting, and Conformance (DMARC) is a method of email authentication to validate mail sent from your Microsoft 365 organization. This validation helps prevent spoofed senders that are used in business email compromise (BEC), ransomware, and other phishing attacks. “You enable DMARC for a domain by creating a TXT record in DNS.” Verify the domains in the MAIL FROM and FROM addresses align: SPF and DKIM don't require the domains in the following email addresses to "align" (match): The MAIL FROM address: The email address used in the transmission of the message between SMTP email servers. This address is also known as the 5321.MailFrom address, P1 sender, or envelope sender. The From address: The email address in the From header field shown as the message sender in email clients. This address is also known as the 5322.From address or P2 sender. For more information about how these email addresses can be in different domains and used for spoofing, see Why internet email needs authentication. DMARC uses the result from SPF to verify both of the following conditions: The message came from an authorized source for the domain used in the MAIL FROM address (the basic requirement of SPF). The domains in the MAIL FROM and From addresses in the message are aligned. This result effectively requires that valid sources for the message must be in the From address domain. DMARC uses the result from DKIM to verify the domain that signed the message (the d= value in a DKIM-Signature header field as validated by the s= selector value) aligns with the domain in the From address. A message passes DMARC if one or both of the described SPF or DKIM checks pass. A message fails DMARC if both of the described SPF and DKIM checks fail.
Your DMARC roll-out plan should use the following steps. Start with a domain or subdomain with low mail volume and/or fewer potential email sources (less chance of legitimate mail from unknown sources being blocked): “You can see how much of your legitimate mail traffic is or isn't covered by DMARC, and troubleshoot any problems.” Increase the DMARC policy to p=quarantine and monitor the results for the domain. After enough time monitoring the effects of p=none, you can increase the DMARC policy to p=quarantine for the domain. For example: DMARC TXT record for marketing.contoso.com: Hostname: _dmarc TXT value: v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]; ruf=mailto:[email protected] You can also use the pct= value to gradually affect more messages and verify the results. For example, you can move in the following increments: pct=10 pct=25 pct=50 pct=75 pct=100
Percentage of failed DMARC mail subject to DMARC policy: Tells the destination email system how many messages that fail DMARC (percentage) get the DMARC policy applied to them. For example, pct=100 means all messages that fail DMARC get the DMARC policy applied to them. You use values less than 100 for testing and tuning of the DMARC policy. If you don't use pct=, the default value is pct=100. “Whether the servers or services pass or fail DMARC authentication.” The amount and variety of DMARC reports varies in the same way that the volume and variety of mail sent from your organization varies. For example, expect lower mail volume during holidays, and higher mail volume during organizational events. It's best to designate specific people to monitor DMARC reports, and to use a specific mailbox or Microsoft 365 Group to receive the DMARC reports (don't deliver the reports to a user's mailbox).
Percentage of failed DMARC mail subject to DMARC policy: Tells the destination email system how many messages that fail DMARC (percentage) get the DMARC policy applied to them. For example, pct=100 means all messages that fail DMARC get the DMARC policy applied to them. You use values less than 100 for testing and tuning of the DMARC policy. If you don't use pct=, the default value is pct=100. “The actions that DMARC takes on mail that fails DMARC authentication (based on the DMARC policy).” The amount and variety of DMARC reports varies in the same way that the volume and variety of mail sent from your organization varies. For example, expect lower mail volume during holidays, and higher mail volume during organizational events. It's best to designate specific people to monitor DMARC reports, and to use a specific mailbox or Microsoft 365 Group to receive the DMARC reports (don't deliver the reports to a user's mailbox).
Your DMARC roll-out plan should use the following steps. Start with a domain or subdomain with low mail volume and/or fewer potential email sources (less chance of legitimate mail from unknown sources being blocked): “You can also see how many fraudulent messages are being sent, and where they're sent from.” Increase the DMARC policy to p=quarantine and monitor the results for the domain. After enough time monitoring the effects of p=none, you can increase the DMARC policy to p=quarantine for the domain. For example: DMARC TXT record for marketing.contoso.com: Hostname: _dmarc TXT value: v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]; ruf=mailto:[email protected] You can also use the pct= value to gradually affect more messages and verify the results. For example, you can move in the following increments: pct=10 pct=25 pct=50 pct=75 pct=100
Percentage of failed DMARC mail subject to DMARC policy: Tells the destination email system how many messages that fail DMARC (percentage) get the DMARC policy applied to them. For example, pct=100 means all messages that fail DMARC get the DMARC policy applied to them. You use values less than 100 for testing and tuning of the DMARC policy. If you don't use pct=, the default value is pct=100. “You should regularly review the DMARC Aggregate reports to monitor where email from your domains is coming from, and to check for unintentional DMARC failures (false positives).” The amount and variety of DMARC reports varies in the same way that the volume and variety of mail sent from your organization varies. For example, expect lower mail volume during holidays, and higher mail volume during organizational events. It's best to designate specific people to monitor DMARC reports, and to use a specific mailbox or Microsoft 365 Group to receive the DMARC reports (don't deliver the reports to a user's mailbox).
Quotes are verbatim and belong to their publishers. Where a quote has been translated, the original wording is kept below it.